# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.196.118
country_id: 1814991
description:
2025-11-18 02:20:40 dovecot_login authenticator failed for ([123.129.196.118]) [123.129.196.118]:33377: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 02:20:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<shbZn9dDFJPBl4nP>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 86.54.31.32
country_id: 2750405
description:
Nov 18 02:20:14 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 3 secs): user=<>, rip=86.54.31.32, lip=191.243.196.56, TLS, session=<fjlkntdDTKxWNh8g>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-18 02:20:17 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:45048: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.137
country_id: 1835841
description:
2025-11-18 02:20:37 dovecot_login authenticator failed for ([121.131.220.137]) [121.131.220.137]:43391: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.237.207.234
country_id: 1814991
description:
2025-11-18 02:20:58 dovecot_login authenticator failed for ([116.237.207.234]) [116.237.207.234]:45518: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 02:20:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<C8kYntdDwOsv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.3.246
country_id: 3017382
description:
2025-11-18 02:20:26 dovecot_login authenticator failed for ([188.231.3.246]) [188.231.3.246]:51803: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.67.190.16
country_id: 1814991
description:
2025-11-18 02:20:28 dovecot_login authenticator failed for (16.190.67.125.broad.gz.sc.dynamic.163data.com.cn) [125.67.190.16]:60698: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yT5wn9dDdpGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.252.21.240
country_id: 1562822
description:
2025-11-18 02:20:43 dovecot_login authenticator failed for (static.vnpt-hanoi.com.vn) [222.252.21.240]:54050: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.164.107.3
country_id: 2510769
description:
2025-11-18 02:20:43 dovecot_login authenticator failed for (3.pool90-164-107.dynamic.orange.es) [90.164.107.3]:48225: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.195.43
country_id: 1269750
description:
2025-11-18 02:20:51 dovecot_login authenticator failed for ([103.129.195.43]) [103.129.195.43]:35286: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2025-11-18 02:21:05 dovecot_login authenticator failed for ([45.115.173.11]) [45.115.173.11]:53915: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.212.92
country_id: 2017370
description:
2025-11-18 02:21:47 dovecot_login authenticator failed for broadband-178-140-212-92.ip.moscow.rt.ru [178.140.212.92]:52254: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:22:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9a/YpNdDCLGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 02:21:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<wG5yoddD8tyGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.16.55
country_id: 3469034
description:
2025-11-18 02:21:37 dovecot_login authenticator failed for ([177.174.16.55]) [177.174.16.55]:60002: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 02:21:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<SHOEotdDgqZSnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 02:21:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@primiciapersianas.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<HlazotdD6I6kXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.102.254.198
country_id: 2017370
description:
2025-11-18 02:21:47 dovecot_login authenticator failed for ([86.102.254.198]) [86.102.254.198]:48036: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2025-11-18 02:21:16 dovecot_login authenticator failed for ([220.67.138.254]) [221.145.5.14]:54698: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.243.245.4
country_id: 3996063
description:
2025-11-18 02:21:21 H=([127.0.1.1]) [104.243.245.4]:4082 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=<noviembred@outlook.com> rejected RCPT <ventas@empresasmexico.com>: "JunkMail rejected - ([127.0.1.1]) [104.243.245.4]:4082 is in an RBL: Listed by CSS, see https://check.spamhaus.org/query/ip/104.243.245.4"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.33.253
country_id: 6290252
description:
2025-11-18 02:21:19 dovecot_login authenticator failed for (dyn-33-253.kbcnet.rs) [109.207.33.253]:45310: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<C/oCo9dDOqixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.237.47.241
country_id: 1835841
description:
2025-11-18 02:21:33 dovecot_login authenticator failed for ([175.237.47.241]) [175.237.47.241]:41917: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.237.6
country_id: 1562822
description:
2025-11-18 02:21:13 dovecot_plain authenticator failed for (v6ouyp0hvn7goacj1s520kc46wjq) [116.104.237.6]:56491: 535 Incorrect authentication data (set_id=marcos@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-11-18 02:21:18 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:49116: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2025-11-18 02:22:08 dovecot_login authenticator failed for (syn-174-134-045-064.res.spectrum.com) [174.134.45.64]:57873: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7ruaptdDvL6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2025-11-18 02:22:39 dovecot_login authenticator failed for ([111.26.63.87]) [111.26.63.87]:41922: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 18 02:22:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<7jg5p9dDzq2dQi/y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2025-11-18 02:22:52 dovecot_login authenticator failed for ([101.13.6.86]) [101.13.6.86]:42428: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-11-18 02:22:16 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:53724: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2025-11-18 02:22:18 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:56238: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.199.32.174
country_id: 3469034
description:
2025-11-18 02:22:21 dovecot_login authenticator failed for ([200.199.32.174]) [200.199.32.174]:37394: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.135.236.30
country_id: 2017370
description:
2025-11-18 02:22:33 dovecot_login authenticator failed for ([79.135.236.30]) [79.135.236.30]:50272: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.111.147.32
country_id: 2017370
description:
2025-11-18 02:22:44 dovecot_login authenticator failed for ([78.111.147.32]) [78.111.147.32]:56196: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-11-18 02:23:22 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:57811: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.50
country_id: 2017370
description:
2025-11-18 02:23:49 dovecot_login authenticator failed for ([89.175.253.50]) [89.175.253.50]:48440: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 18 02:24:02 hosting dovecot: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=200.150.207.122, session=</Ir+q9dDeM0Dg9cm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.11.15.126
country_id: 3469034
description:
2025-11-18 02:24:05 dovecot_login authenticator failed for ([189.11.15.126]) [189.11.15.126]:43834: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.76.5.36
country_id: 2017370
description:
2025-11-18 02:23:10 dovecot_login authenticator failed for (pppoe-87-76-5.36.evolife.su) [87.76.5.36]:46512: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 02:23:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fernandotonet.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<D5goqddD9pukXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 02:23:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<GTuIqddDCJUI1et7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 02:23:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<Q822qddDDt1CYSpH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<LkwwqtdDLtCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.135.26.217
country_id: 798544
description:
2025-11-18 02:23:09 dovecot_login authenticator failed for ([31.135.26.217]) [31.135.26.217]:34388: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 18 02:25:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<IoqFr9dDHIqiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-11-18 02:24:09 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:55432: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.131
country_id: 1835841
description:
2025-11-18 02:24:22 dovecot_login authenticator failed for ([1.235.192.131]) [1.235.192.131]:34794: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4Gu9rddD7OexV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:25:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<n8CHr9dD/ICxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 02:24:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@primiciapersianas.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<5a5orNdDnqt2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.100
country_id: 3686110
description:
2025-11-18 02:24:42 dovecot_login authenticator failed for ([191.102.75.65]) [186.179.100.100]:1255: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 02:24:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<VmtfrtdDLuXBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 02:25:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<9Q6OstdDDtRns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.76.5.36
country_id: 2017370
description:
2025-11-18 02:25:53 dovecot_login authenticator failed for (pppoe-87-76-5.36.evolife.su) [87.76.5.36]:52184: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.186.183.88
country_id: 2017370
description:
2025-11-18 02:25:09 dovecot_login authenticator failed for (188x186x183x88.dynamic.tmn.ertelecom.ru) [188.186.183.88]:40110: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.76.73.4
country_id: 1814991
description:
2025-11-18 02:25:25 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:63865: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:25:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Eh5esddD/JCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 18 02:25:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<CwZbsddDbLSnR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 02:26:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<Vh6ys9dDXpxA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.85.118.147
country_id: 1814991
description:
2025-11-18 02:26:21 dovecot_login authenticator failed for ([111.85.118.147]) [111.85.118.147]:58775: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yzvvtNdDyqSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 02:26:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<eMiNtddDPJNrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 02:27:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@pousadarincaoalegre.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<nepAt9dDpMhzR+4E>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zEt3uNdDQLexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 18 02:27:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=<184ouddDsr2qQMFo>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:28:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KFdFutdD+sWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 116.71.133.131
country_id: 1168579
description:
Nov 18 02:27:08 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<jesse@pousadarincaoalegre.com.br>, method=PLAIN, rip=116.71.133.131, lip=200.150.196.245, TLS, session=<1tHktddDDIV0R4WD>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 02:27:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<oh5ct9dD7rtn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 02:27:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<yzGJt9dDIKaB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-18 02:27:55 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:54286: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 02:28:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<xZQtu9dDgK3SchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 02:28:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<db7lu9dDNIItPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.224.227.120
country_id: 1835841
description:
2025-11-18 02:28:40 dovecot_login authenticator failed for ([211.224.227.120]) [211.224.227.120]:37090: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.0.185
country_id: 2017370
description:
2025-11-18 02:28:48 dovecot_login authenticator failed for ([46.44.0.185]) [46.44.0.185]:50768: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.133.35
country_id: 2017370
description:
2025-11-18 02:28:53 dovecot_login authenticator failed for ([92.124.133.35]) [92.124.133.35]:55232: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.239.181.182
country_id: 1835841
description:
2025-11-18 02:28:20 dovecot_login authenticator failed for ([211.239.181.182]) [211.239.181.182]:45660: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IRgLvNdD2s2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2025-11-18 02:29:04 dovecot_login authenticator failed for ([119.192.59.80]) [119.192.59.80]:42018: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2025-11-18 02:29:11 dovecot_login authenticator failed for (223-197-145-33.static.imsbiz.com) [223.197.145.33]:50085: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2025-11-18 02:29:25 dovecot_login authenticator failed for ([121.159.71.249]) [121.159.71.249]:33178: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 02:29:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<g2wDwddDKIFCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 02:29:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<kA6zvtdDWp5ns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5Euov9dDuuSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2025-11-18 02:29:39 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:16181: 535 Incorrect authentication data (set_id=bruno)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2025-11-18 02:29:09 dovecot_login authenticator failed for (syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:62548: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.102.254.198
country_id: 2017370
description:
2025-11-18 02:29:23 dovecot_login authenticator failed for ([86.102.254.198]) [86.102.254.198]:37975: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-18 02:29:25 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:50681: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-11-18 02:29:32 dovecot_login authenticator failed for ([49.206.201.253]) [49.206.201.253]:38216: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.50.155
country_id: 1269750
description:
2025-11-18 02:29:40 dovecot_login authenticator failed for (abts-north-static-155.50.160.122.airtelbroadband.in) [122.160.50.155]:39621: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
country_id: 6252001
description:
2025-11-18 02:29:46 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.64.170]:42464: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.186
country_id: 1269750
description:
2025-11-18 02:29:22 dovecot_login authenticator failed for ([182.95.49.186]) [182.95.49.186]:41420: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2025-11-18 02:30:05 dovecot_login authenticator failed for (217-29-30-135.saimanet.kg) [217.29.30.135]:42388: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.212.101
country_id: 2017370
description:
2025-11-18 02:30:11 dovecot_login authenticator failed for (net212.234.188-101.ertelecom.ru) [188.234.212.101]:49868: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 02:30:13 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51877: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2025-11-18 02:30:27 dovecot_login authenticator failed for ([197.219.228.250]) [197.219.228.250]:41116: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 02:30:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<m5YWxNdDmdF3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 02:31:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<eCDtxNdDvs2YNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 02:31:06 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:49435: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2025-11-18 02:30:07 dovecot_login authenticator failed for (nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:47592: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Oqg6w9dDmIixV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:31:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<C7YKxddDWJaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.253.239
country_id: 1819730
description:
2025-11-18 02:31:04 dovecot_login authenticator failed for (161.81.253.239.hk.chinamobile.com) [161.81.253.239]:57084: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.198.51
country_id: 1814991
description:
2025-11-18 02:31:40 dovecot_login authenticator failed for ([157.122.198.51]) [157.122.198.51]:59589: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 02:31:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<wiecx9dDeORSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 02:31:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<N8IcyNdDHl6vfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-11-18 02:32:02 dovecot_login authenticator failed for ([187.51.128.233]) [189.44.133.238]:50263: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.48.24.152
country_id: 1269750
description:
2025-11-18 02:32:04 dovecot_login authenticator failed for ([171.48.24.152]) [171.48.24.152]:47881: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 02:31:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<EeJHxtdDvucv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 02:31:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<gfTKxtdDDN2UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 02:31:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<ijhWx9dDHJkO4dKR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-18 02:31:59 dovecot_login authenticator failed for ([182.95.176.194]) [182.95.176.194]:47866: 535 Incorrect authentication data (set_id=brizola)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.161.17.124
country_id: 2017370
description:
2025-11-18 02:31:19 dovecot_login authenticator failed for ([81.161.17.124]) [81.161.17.124]:63308: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BQjNxtdD8p6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 02:32:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<ynmlyddDXr0rmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
country_id: 1036973
description:
2025-11-18 02:32:24 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:39410: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 02:32:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<hwbHytdD3o3SchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-11-18 02:32:49 dovecot_login authenticator failed for (dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:34002: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 02:32:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@alcantaraemonteiro.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<2Cafy9dDjJ92wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 02:32:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<Q+HTyNdDCpxn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-11-18 02:32:17 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:48926: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2025-11-18 02:32:29 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:58435: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:32:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<X+1mytdDcLexV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:33:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<l9f6zddDGNmxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:34:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KO67z9dDCuGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 02:34:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<Ntmtz9dDTtIkMrBu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 02:33:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<n3F/zddDgJI+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 02:35:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<m/Iv09dDMLul0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 02:34:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<bfpq0NdDztVrhr+5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<wROI0ddDkOmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 02:34:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<vYbv0ddDgpmB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 02:34:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<agf/0ddDmJ2ElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-11-18 02:35:18 dovecot_login authenticator failed for (78.186.54.65.static.ttnet.com.tr) [78.186.54.65]:39788: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:35:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<pwIh1ddDNJOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 18 02:35:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<uvvX1ddDcKJbejg7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 18 02:36:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@joelbuenoadvogados.com.br>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<5g/y1tdD9u0rZDwA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
country_id: 1814991
description:
2025-11-18 02:35:08 dovecot_login authenticator failed for ([218.22.0.200]) [218.22.0.200]:47826: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<pUyq2NdDlqmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 02:36:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<AOmm2NdDEtCUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 02:36:54 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:59232: 535 Incorrect authentication data (set_id=root@jacgeneralcleaning.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 02:36:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<dm0T2tdDKOstPZWl>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:37:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<q8Vw2tdD/rKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 02:37:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<x2G+29dDWpcv+yzS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:37:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HDJJ3NdDXMKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 02:37:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@oabsjp.org.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<zrUr3NdDgt6kXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 02:37:46 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:61939: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 02:37:48 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:65090: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.199.98
country_id: 2077456
description:
2025-11-18 02:38:48 dovecot_login authenticator failed for 111-220-199-98.dyn.ip.vocus.au [111.220.199.98]:51178: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-18 02:38:23 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:63340: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 02:38:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<OF2g39dDdudAF/Qn>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<f+3P39dDItKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2025-11-18 02:40:00 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:59798: 535 Incorrect authentication data (set_id=faturamento)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:40:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MrAw5ddDVoWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.58.130.22
country_id: 1814991
description:
2025-11-18 02:40:02 dovecot_login authenticator failed for ([58.58.130.22]) [58.58.130.22]:53215: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-11-18 02:39:39 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:54519: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-11-18 02:39:40 dovecot_login authenticator failed for ([125.17.48.129]) [152.52.210.118]:33830: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 02:39:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<vUlC5NdDXNCd5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 02:39:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fernandotonet.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<9+Hg4tdDJJR2wSaf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:39:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<k09w49dDEumxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2025-11-18 02:39:49 dovecot_login authenticator failed for ([188.126.240.80]) [188.126.240.80]:48938: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2025-11-18 02:40:03 dovecot_login authenticator failed for ([218.156.93.203]) [218.156.93.203]:44459: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 02:39:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<qRr44ddDZMwXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 02:39:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<uY254tdD2rBA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.118
country_id: 1269750
description:
2025-11-18 02:39:25 dovecot_login authenticator failed for ([128.185.247.53]) [182.95.222.118]:44348: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.171.195.147
country_id: 1562822
description:
2025-11-18 02:39:25 dovecot_login authenticator failed for (static.vnpt.vn) [14.171.195.147]:52357: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2025-11-18 02:39:33 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:44044: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.67.20
country_id: 1643084
description:
2025-11-18 02:40:16 dovecot_login authenticator failed for ([157.15.67.57]) [157.15.67.20]:52921: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-11-18 02:40:17 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12052: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.100.48
country_id: 1814991
description:
2025-11-18 02:40:26 dovecot_login authenticator failed for ([36.135.100.48]) [36.135.100.48]:52730: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ijkA59dD4paxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.155.213.175
country_id: 1668284
description:
2025-11-18 02:40:33 dovecot_login authenticator failed for 182-155-213-175.veetime.com [182.155.213.175]:57582: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 02:40:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<Z4Eh6NdDHMyl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-18 02:41:01 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:55782: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2025-11-18 02:40:22 dovecot_login authenticator failed for (nsg-static-130.86.76.182-airtel.com) [182.76.86.130]:50418: 535 Incorrect authentication data (set_id=paulo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.126
country_id: 1814991
description:
2025-11-18 02:40:31 dovecot_login authenticator failed for ([111.26.95.126]) [111.26.95.126]:35942: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 83.143.27.9
country_id: 933860
description:
Nov 18 02:40:16 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<rh3@maringasoldas.com.br>, method=PLAIN, rip=83.143.27.9, lip=200.150.196.245, TLS, session=<CsjD5NdDyaxTjxsJ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2025-11-18 02:40:16 -0300] info [cpaneld] 165.22.212.32 - adlondri "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.172.33.52
country_id: 1814991
description:
2025-11-18 02:40:23 dovecot_login authenticator failed for ([180.172.33.52]) [180.172.33.52]:38478: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-11-18 02:40:31 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:54034: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 02:40:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<ksrd5tdDMrWB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 02:40:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=</T9T6NdDjJqkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.221.220.37
country_id: 1814991
description:
2025-11-18 02:40:22 dovecot_login authenticator failed for ([183.221.220.37]) [183.221.220.37]:35334: 535 Incorrect authentication data (set_id=secretarioadjunto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-18 02:40:53 dovecot_login authenticator failed for ([61.246.66.225]) [182.95.174.18]:32888: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.6.16.137
country_id: 1835841
description:
2025-11-18 02:40:56 dovecot_login authenticator failed for ([14.6.16.137]) [14.6.16.137]:37418: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2025-11-18 02:40:59 dovecot_login authenticator failed for ([121.128.76.110]) [211.196.31.2]:33234: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-18 02:41:28 dovecot_login authenticator failed for ([125.19.82.193]) [182.95.115.70]:45874: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7p2T6tdDdKuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.149.29.222
country_id: 2017370
description:
2025-11-18 02:41:34 dovecot_login authenticator failed for ([83.149.29.222]) [83.149.29.222]:45080: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 02:41:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@highqualityautoparts.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<Hz7o6tdDdLI+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 02:42:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<brQV7NdDXstzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.160.60
country_id: 1814991
description:
2025-11-18 02:41:11 dovecot_login authenticator failed for ([121.11.160.60]) [121.11.160.60]:50044: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 02:41:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<pi1A6ddDpjNo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.17.96
country_id: 2077456
description:
2025-11-18 02:41:27 dovecot_login authenticator failed for ([120.157.17.96]) [120.157.17.96]:52414: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 02:42:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<LUB77ddDwZB3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 02:42:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<9ti+7ddDrL+Gx8nN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<m74c7tdDtL2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-11-18 02:42:51 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:57536: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:43:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7v3q79dD4M2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.62.212.142
country_id: 2658434
description:
2025-11-18 02:43:05 dovecot_login authenticator failed for 142.212.62.81.static.wline.lns.sme.cust.swisscom.ch [81.62.212.142]:41614: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.7
country_id: 1668284
description:
2025-11-18 02:42:09 dovecot_login authenticator failed for 111-70-32-7.emome-ip.hinet.net [111.70.32.7]:49377: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 02:43:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<i+G98tdDMtZw2eny>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2025-11-18 02:43:57 dovecot_login authenticator failed for ([115.141.143.58]) [115.141.143.58]:37123: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 02:43:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<hTQl8ddDuLpns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 02:43:30 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:64991: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<le278ddDUtaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-18 02:43:33 dovecot_login authenticator failed for ([125.20.43.41]) [103.251.31.34]:46750: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-18 02:43:46 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:38754: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2025-11-18 02:44:06 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:56087: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.164.159.86
country_id: 1814991
description:
2025-11-18 02:44:37 dovecot_login authenticator failed for ([119.164.159.86]) [119.164.159.86]:43047: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 02:44:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<BGTi9ddDBP+KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2025-11-18 02:44:47 dovecot_login authenticator failed for ([108.143.69.79]) [108.143.69.79]:58544: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 18 02:45:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<0+Lc9tdDwqSWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 02:44:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<Hc0B9ddDotdo7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JQxM9ddDjICxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.9.39
country_id: 1269750
description:
2025-11-18 02:44:46 dovecot_login authenticator failed for (49.207.9.39.actcorp.in) [49.207.9.39]:50852: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.116.184
country_id: 1814991
description:
2025-11-18 02:44:12 dovecot_login authenticator failed for ([123.139.116.184]) [123.139.116.184]:59974: 535 Incorrect authentication data (set_id=vanessalima)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 02:44:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<RYN/9NdDqNGYNbyQ>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 151.243.109.221
country_id: 2750405
description:
[2025-11-18 02:44:21 -0300] info [webmaild] 151.243.109.221 - eleicoes@1075fm.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.225.32.239
country_id: 1562822
description:
2025-11-18 02:44:22 dovecot_login authenticator failed for ([14.225.32.239]) [14.225.32.239]:55947: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1sfj+NdDKJuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 02:45:53 dovecot_login authenticator failed for (User) [177.74.174.120]:61058: 535 Incorrect authentication data (set_id=santos@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.194
country_id: 1269750
description:
2025-11-18 02:46:01 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:39372: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:46:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2dKp+tdD7qexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 02:46:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<ayOr+tdDnutxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.108.150
country_id: 1668284
description:
2025-11-18 02:45:26 dovecot_login authenticator failed for (175-182-108-150.adsl.dynamic.seed.net.tw) [175.182.108.150]:33570: 535 Incorrect authentication data (set_id=sales@globalmedica.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 94.198.210.128
country_id: 3175395
description:
Nov 18 02:45:29 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos@maringasoldas.com.br>, method=PLAIN, rip=94.198.210.128, lip=200.150.196.245, TLS, session=<UXag99dDwNNextKA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 18 02:45:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ieq.com.br>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<FbbW+ddDEpOnR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 02:46:09 dovecot_login authenticator failed for (User) [177.74.174.120]:61058: 535 Incorrect authentication data (set_id=santos@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 02:46:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<1oJb+9dDTMM7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.113.129.120
country_id: 2017370
description:
2025-11-18 02:46:31 dovecot_login authenticator failed for (37x113x129x120.static-business.chel.ertelecom.ru) [37.113.129.120]:50604: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 18 02:46:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<pyZY+9dDLIov+wDY>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<31hr/NdDrLGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-11-18 02:46:33 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:38295: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 02:46:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<oByp/NdDesWYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.28.177.141
country_id: 2017370
description:
2025-11-18 02:46:49 dovecot_login authenticator failed for ([37.28.177.141]) [37.28.177.141]:49694: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 18 02:46:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@huboperacoes.com>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<OX+h/ddDvNsrZDwA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2025-11-18 02:47:03 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:54833: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.183.3.58
country_id: 1814991
description:
2025-11-18 02:46:12 dovecot_login authenticator failed for ([1.183.3.58]) [1.183.3.58]:56838: 535 Incorrect authentication data (set_id=sales@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.78.247
country_id: 2017370
description:
2025-11-18 02:46:44 dovecot_login authenticator failed for 89-179-78-247.broadband.corbina.ru [89.179.78.247]:52016: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.208
country_id: 6252001
description:
2025-11-18 02:46:45 dovecot_login authenticator failed for ([107.85.14.208]) [107.85.14.208]:55939: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 02:46:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<WsdN/ddDVuekXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-18 02:47:54 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:46596: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2025-11-18 02:47:16 dovecot_login authenticator failed for 42-200-73-3.static.imsbiz.com [42.200.73.3]:39058: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2025-11-18 02:47:17 dovecot_login authenticator failed for (m121-202-138-181.smartone.com) [121.202.138.181]:59826: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 02:47:42 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52212: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 02:47:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<gjE5ANhDxsJSnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 02:47:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<DP0IAdhDpJqvfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 18 02:47:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<L1kyAdhDwoAvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 02:48:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<A4WVAdhDnJ9AF/Qn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 02:47:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<uJ5u/9dDFoItPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-18 02:47:30 dovecot_login authenticator failed for ([125.20.245.182]) [125.20.245.182]:39186: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Wnz//9dDis6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 02:48:24 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:62785: 535 Incorrect authentication data (set_id=postamster@ciadoluminoso.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 02:48:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<FKxJA9hD8pMtPZWl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YNGcA9hD2OqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 02:48:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<omXtA9hDLtid5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.82.40.34
country_id: 1694008
description:
2025-11-18 02:49:01 dovecot_login authenticator failed for ([203.82.40.34]) [203.82.40.34]:46620: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:49:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ANhmBdhDPoexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 02:48:13 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52244: 535 Incorrect authentication data (set_id=nfe2@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.78.23
country_id: 290557
description:
2025-11-18 02:48:21 dovecot_login authenticator failed for ([5.30.78.23]) [5.30.78.23]:54262: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.100.48
country_id: 241170
description:
Nov 18 02:48:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<desenvolvimento@inovasite.com>, method=PLAIN, rip=196.251.100.48, lip=200.150.196.245, session=<uTlHA9hDfKXE+2Qw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 02:48:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<HU9SBNhDBINA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 02:48:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<MKRyBNhDkrtxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.20.106.40
country_id: 2017370
description:
2025-11-18 02:50:05 dovecot_login authenticator failed for (89.20.106.40.permonline.ru) [89.20.106.40]:59513: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 02:50:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<bnAkCdhDPruKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.96.146
country_id: 1835841
description:
2025-11-18 02:49:27 dovecot_login authenticator failed for ([211.252.96.146]) [211.252.96.146]:43236: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<p+MrB9hD1JOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 02:50:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<IWP8CthDuJB9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.33.227
country_id: 1668284
description:
2025-11-18 02:50:42 dovecot_login authenticator failed for 111-70-33-227.emome-ip.hinet.net [111.70.33.227]:46367: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-11-18 02:51:03 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:38051: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 02:51:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@toromartelinho.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<8veDDNhDbKBzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.103.30
country_id: 1814991
description:
2025-11-18 02:50:14 dovecot_login authenticator failed for ([36.135.103.30]) [36.135.103.30]:39538: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dIa+CthDLq2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 02:51:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<fGPjDNhD3OAI2Cjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 02:51:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<WnTGDthDrKaP9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 02:51:44 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51626: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
country_id: 3469034
description:
2025-11-18 02:51:52 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [186.215.107.189]:40577: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.88
country_id: 1814991
description:
2025-11-18 02:51:59 dovecot_login authenticator failed for ([27.24.141.88]) [27.24.141.88]:39508: 535 Incorrect authentication data (set_id=misterthomas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2025-11-18 02:52:06 dovecot_login authenticator failed for ([111.26.63.87]) [111.26.63.87]:48008: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.97.134
country_id: 294640
description:
2025-11-18 02:51:28 dovecot_login authenticator failed for (2-54-97-134.orange.net.il) [2.54.97.134]:35640: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:51:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ndJZDthDBMqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-11-18 02:51:38 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:46459: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.183.100.27
country_id: 2017370
description:
2025-11-18 02:51:41 dovecot_login authenticator failed for (argument.net.tomline.ru) [213.183.100.27]:60582: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-11-18 02:51:52 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:50476: 535 Incorrect authentication data (set_id=sales@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.177
country_id: 2215636
description:
2025-11-18 02:51:06 dovecot_login authenticator failed for ([102.38.3.177]) [102.38.3.177]:37982: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.155.199.176
country_id: 3469034
description:
Nov 18 02:51:32 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=<PAxMDthDB/yxm8ew>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.155.199.176
country_id: 3469034
description:
Nov 18 02:51:35 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, session=<00V/DthD7/yxm8ew>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.230.188
country_id: 1835841
description:
2025-11-18 02:51:43 dovecot_login authenticator failed for ([220.124.230.188]) [220.124.230.188]:43657: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-18 02:52:02 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:52242: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-11-18 02:51:19 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:60662: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.178
country_id: 1269750
description:
2025-11-18 02:52:05 dovecot_login authenticator failed for ([182.95.46.178]) [182.95.46.178]:34472: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.181
country_id: 2186224
description:
2025-11-18 02:52:45 dovecot_login authenticator failed for ([121.73.168.181]) [121.73.168.181]:35858: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 02:52:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@f5assessoria.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<2e5VE9hDyod2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-18 02:52:08 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:33286: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-11-18 02:52:21 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:50579: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-11-18 02:52:21 dovecot_login authenticator failed for ([46.8.245.34]) [46.8.245.34]:45278: 535 Incorrect authentication data (set_id=misterthomas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2025-11-18 02:52:31 dovecot_login authenticator failed for ([200.37.179.83]) [200.37.179.83]:37261: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4YfnEdhDpOaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 02:52:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<pgspEthDWNYkMrBu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 18 02:52:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<8jywENhD7s0zTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.11.230.160
country_id: 2510769
description:
2025-11-18 02:52:20 dovecot_login authenticator failed for 160.red-88-11-230.dynamicip.rima-tde.net [88.11.230.160]:50104: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.1.56
country_id: 2017370
description:
2025-11-18 02:52:33 dovecot_login authenticator failed for broadband-5-228-1-56.ip.moscow.rt.ru [5.228.1.56]:54168: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
country_id: 1835841
description:
2025-11-18 02:53:03 dovecot_login authenticator failed for ([1.235.192.130]) [1.235.192.130]:51797: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-18 02:53:10 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:39444: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:53:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tXaBFdhDyo6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 02:53:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<WQCRFthDbq6UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 02:54:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<uqyIGNhD6oGElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-18 02:54:34 dovecot_login authenticator failed for (allsegsst.com.br) [112.122.54.54]:32062: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.221.133.78
country_id: 1269750
description:
Nov 18 02:54:35 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@deproi.com.br>, method=PLAIN, rip=117.221.133.78, lip=200.150.196.245, TLS, session=<+OXpF9hDS7F13YVO>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.72.153.110
country_id: 290557
description:
Nov 18 02:54:57 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=91.72.153.110, lip=200.150.196.245, TLS, session=<iZtaGdhDTuNbSJlu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 18 02:54:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<IlmBGNhDWnS317Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 02:54:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<PPOFGNhD8MonaoFh>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<s9EQGdhDuKqxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:55:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Bh/eGthDOrqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 02:56:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<+4pOHthDRY53xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.144.50
country_id: 3175395
description:
2025-11-18 02:55:10 dovecot_login authenticator failed for ([101.58.144.50]) [101.58.144.50]:48121: 535 Incorrect authentication data (set_id=kgl@kglsolucoes.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.51.5
country_id: 1668284
description:
2025-11-18 02:55:25 dovecot_login authenticator failed for 111-70-51-5.emome-ip.hinet.net [111.70.51.5]:52988: 535 Incorrect authentication data (set_id=supports@opsconsorcios.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 02:55:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<HCMAHNhDfsVvAEul>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hmqjHNhDBsixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.171.27.248
country_id: 1814991
description:
2025-11-18 02:55:39 dovecot_login authenticator failed for ([116.171.27.248]) [116.171.27.248]:55778: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 02:55:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<elIdHdhDItd9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-11-18 02:55:20 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:40600: 535 Incorrect authentication data (set_id=kgl)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 02:55:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<IU7vG9hDWJWnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2025-11-18 02:56:14 dovecot_login authenticator failed for (65-181-79-060.static.imsbiz.com) [65.181.79.60]:58352: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.171.125
country_id: 1562822
description:
2025-11-18 02:56:28 dovecot_login authenticator failed for ([113.160.171.125]) [113.160.171.125]:19152: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-11-18 02:56:35 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:60242: 535 Incorrect authentication data (set_id=supports)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
country_id: 1814991
description:
2025-11-18 02:56:42 dovecot_login authenticator failed for ([61.169.54.150]) [61.169.54.150]:44637: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 02:56:47 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:59184: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 02:56:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<iDOkHthDvp1CYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 02:56:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<eWYRH9hDqJ0rmxBp>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<B0IvINhDZOWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 02:56:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<yAFSINhD8LInaoFh>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<o9LNI9hDGI2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2025-11-18 02:57:33 dovecot_login authenticator failed for 111-70-32-10.emome-ip.hinet.net [111.70.32.10]:38924: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 02:57:44 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52181: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.93.213
country_id: 1668284
description:
2025-11-18 02:57:59 dovecot_login authenticator failed for 110-25-93-213.adsl.fetnet.net [110.25.93.213]:41266: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Nov 18 02:58:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=<pwpnJdhDDp3BHmEh>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:58:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ILGVJdhDMJ2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 18 02:57:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<d/I+I9hDjsEkMrGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.15.132
country_id: 1814991
description:
2025-11-18 02:57:43 dovecot_login authenticator failed for ([222.128.15.132]) [222.128.15.132]:37754: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 02:58:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<1atkJthDGO3Bl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 02:58:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<StWBJthD/p6B4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2025-11-18 02:58:26 dovecot_login authenticator failed for ([203.252.10.4]) [203.252.10.4]:30390: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WAhgJ9hDXKaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 02:58:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<nSIRKNhDquMv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 18 02:59:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<eyYrKdhDALcIiXsk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 02:58:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<fW8iJ9hDhKdSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 02:59:01 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52298: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-18 02:59:06 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:55760: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.141
country_id: 3469034
description:
2025-11-18 03:00:02 dovecot_login authenticator failed for (centrodenefrologia.static.gvt.net.br) [177.207.248.141]:53136: 535 Incorrect authentication data (set_id=escritura1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 02:59:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<9ptPKdhDTYR3xBIC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QeTpKthDAMGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 02:59:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<ta/kKthDYo1n9M4G>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<an58LthD4NmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 03:00:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=</lePLthDBuJns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 03:00:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<ygmgLthDBsZvAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.141.122.210
country_id: 2017370
description:
2025-11-18 03:00:48 dovecot_login authenticator failed for ([5.141.122.210]) [5.141.122.210]:58616: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:01:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<O3ZFMNhDbuOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 03:00:19 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52121: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 18 03:00:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<j7f0LdhDusl57bKF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2025-11-18 03:01:09 dovecot_login authenticator failed for ([115.141.143.58]) [115.141.143.58]:33896: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 03:01:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<0ZqgMdhD8IyGx8nN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BB4ZMthDEuyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.171.157
country_id: 1814991
description:
2025-11-18 03:01:59 dovecot_login authenticator failed for ([220.180.171.157]) [220.180.171.157]:40342: 535 Incorrect authentication data (set_id=memaagostinho@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.118
country_id: 1269750
description:
2025-11-18 03:03:06 dovecot_login authenticator failed for ([128.185.247.53]) [182.95.222.118]:52052: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-11-18 03:02:10 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:48818: 535 Incorrect authentication data (set_id=memaagostinho)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 03:02:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<GdMqNdhDVJ6l0iHB>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<jdejNdhDXpaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 03:02:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@oabsjp.org.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<NZ+nNdhDHO52wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 03:02:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<GV3nNdhDgIiP9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-11-18 03:02:51 dovecot_login authenticator failed for ([65.20.143.159]) [65.20.143.159]:44770: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.220.245.109
country_id: 2017370
description:
2025-11-18 03:03:29 dovecot_login authenticator failed for ([83.220.245.109]) [83.220.245.109]:56196: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<pjU7OdhDwLCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.234.161
country_id: 587116
description:
2025-11-18 03:03:56 dovecot_login authenticator failed for ([94.20.234.161]) [94.20.234.161]:54366: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 03:03:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<dMOYOthD2olSnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 03:03:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<Pam8OthDnu2nYwhf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:04:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zQEOO9hDQLmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
country_id: 3469034
description:
2025-11-18 03:04:03 dovecot_login authenticator failed for ([189.80.46.250]) [189.80.46.250]:38185: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2025-11-18 03:04:47 dovecot_login authenticator failed for ([106.247.22.181]) [106.247.22.181]:38787: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2025-11-18 03:04:11 dovecot_login authenticator failed for ([211.169.212.206]) [211.169.212.206]:63106: 535 Incorrect authentication data (set_id=sales@calcautomacao.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 03:04:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<KEQfPNhDetYI1et7>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TszQPNhD2sexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.17.247.90
country_id: 1814991
description:
2025-11-18 03:04:40 dovecot_login authenticator failed for (90.247.17.175.adsl-pool.jlccptt.net.cn) [175.17.247.90]:21298: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-11-18 03:04:33 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:50691: 535 Incorrect authentication data (set_id=sales@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-11-18 03:04:34 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:57694: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-18 03:04:58 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:52833: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 03:04:09 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:57059: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.177.4.91
country_id: 1694008
description:
2025-11-18 03:04:20 dovecot_login authenticator failed for ([203.177.4.91]) [203.177.4.91]:6467: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.79.87.53
country_id: 6252001
description:
2025-11-18 03:04:24 dovecot_login authenticator failed for wsip-174-79-87-53.br.br.cox.net [174.79.87.53]:51623: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.156
country_id: 1269750
description:
2025-11-18 03:04:31 dovecot_login authenticator failed for (dhcp-192-211-156.in2cable.com) [203.192.211.156]:35646: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.172.33.52
country_id: 1814991
description:
2025-11-18 03:05:11 dovecot_login authenticator failed for ([180.172.33.52]) [180.172.33.52]:58444: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:05:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tlJrQNhDmNuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.177.110
country_id: 1835841
description:
2025-11-18 03:06:00 dovecot_login authenticator failed for ([218.154.54.5]) [222.108.177.110]:47653: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.249.16
country_id: 298795
description:
2025-11-18 03:06:53 dovecot_login authenticator failed for ([5.11.249.16]) [5.11.249.16]:47874: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2025-11-18 03:06:57 dovecot_login authenticator failed for syn-024-105-160-100.biz.spectrum.com [24.105.160.100]:60806: 535 Incorrect authentication data (set_id=sandromiguel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.39.63.46
country_id: 1814991
description:
2025-11-18 03:06:13 dovecot_login authenticator failed for ([117.39.63.46]) [117.39.63.46]:49065: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.38.221.138
country_id: 1814991
description:
2025-11-18 03:06:23 dovecot_login authenticator failed for ([111.38.221.138]) [111.38.221.138]:53940: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 18 03:06:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<YRCkQ9hDqKWiAOAm>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uaT7Q9hDNoSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 03:06:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<mkf8Q9hDIM7Bl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2025-11-18 03:06:50 dovecot_login authenticator failed for ([128.185.253.98]) [128.185.253.98]:33780: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 03:06:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<9+xpRdhDDNSl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.50.162.66
country_id: 2017370
description:
2025-11-18 03:07:02 dovecot_login authenticator failed for ([94.50.162.66]) [94.50.162.66]:59079: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-18 03:06:09 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:64927: 535 Incorrect authentication data (set_id=processos.daniel@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.141.80.56
country_id: 2017370
description:
2025-11-18 03:06:35 dovecot_login authenticator failed for (adsl-5-141-80-56.salekhard.ru) [5.141.80.56]:54079: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 03:06:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<XBN1RNhD1pA+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.100.39.180
country_id: 2017370
description:
2025-11-18 03:06:44 dovecot_login authenticator failed for ([92.100.39.180]) [92.100.39.180]:42273: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 03:06:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<fzxWQ9hDzLFCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 03:06:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<Y3D3Q9hDUJtns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.176.229.36
country_id: 2017370
description:
2025-11-18 03:06:42 dovecot_login authenticator failed for ([178.176.229.36]) [178.176.229.36]:57872: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 03:06:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<CXVQQthDPNNrhr+5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:07:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Nn3IRdhDbo2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 03:07:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<6/p6RthDfIVn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.91.119
country_id: 2017370
description:
2025-11-18 03:07:20 dovecot_login authenticator failed for ([178.68.91.119]) [178.68.91.119]:36425: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.212.101
country_id: 2017370
description:
2025-11-18 03:07:28 dovecot_login authenticator failed for (net212.234.188-101.ertelecom.ru) [188.234.212.101]:55194: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.141.77.192
country_id: 2017370
description:
2025-11-18 03:07:34 dovecot_login authenticator failed for ppp85-141-77-192.pppoe.mtu-net.ru [85.141.77.192]:52942: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.64.207.52
country_id: 6252001
description:
2025-11-18 03:07:54 dovecot_login authenticator failed for c-75-64-207-52.hsd1.la.comcast.net [75.64.207.52]:40622: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.88
country_id: 1814991
description:
2025-11-18 03:07:53 dovecot_login authenticator failed for ([111.26.100.88]) [111.26.100.88]:34880: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.252.110
country_id: 1269750
description:
2025-11-18 03:07:29 dovecot_login authenticator failed for ([125.23.235.136]) [128.185.252.110]:45428: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<b9WFR9hDmJuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-11-18 03:07:32 dovecot_login authenticator failed for ([154.146.240.123]) [154.146.240.123]:43614: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.121.234.5
country_id: 1814991
description:
2025-11-18 03:07:36 dovecot_login authenticator failed for ([118.121.233.158]) [118.121.234.5]:41432: 535 Incorrect authentication data (set_id=faturamento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.95.221
country_id: 2017370
description:
2025-11-18 03:07:41 dovecot_login authenticator failed for broadband-178-140-95-221.ip.moscow.rt.ru [178.140.95.221]:48384: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.152.206.155
country_id: 1814991
description:
2025-11-18 03:08:14 dovecot_login authenticator failed for ([219.152.206.155]) [219.152.206.155]:47582: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.18.150
country_id: 1835841
description:
2025-11-18 03:08:19 dovecot_login authenticator failed for ([112.162.18.150]) [112.162.18.150]:60208: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qE4jS9hDRrCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2025-11-18 03:08:32 dovecot_login authenticator failed for ([115.141.143.58]) [115.141.143.58]:57907: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
country_id: 1814991
description:
2025-11-18 03:08:33 dovecot_login authenticator failed for ([1.82.135.154]) [1.82.135.154]:41073: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-18 03:08:52 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:33274: 535 Incorrect authentication data (set_id=misterthomas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.49
country_id: 1668284
description:
2025-11-18 03:08:12 dovecot_login authenticator failed for 111-70-32-49.emome-ip.hinet.net [111.70.32.49]:51166: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:10:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<e6OBUNhDatCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 03:09:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<EGVvTthDhtyYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.245.138.2
country_id: 1269750
description:
2025-11-18 03:09:40 dovecot_login authenticator failed for ([117.245.138.2]) [117.245.138.2]:46010: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 03:09:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<SpWnT9hD5OeB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
country_id: 1668284
description:
2025-11-18 03:09:56 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:50548: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 03:09:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<eT0sUNhDwtNns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-18 03:09:21 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:51580: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1yeyTthDmsGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.219.232.34
country_id: 1835841
description:
2025-11-18 03:09:52 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:43866: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.138.178
country_id: 1814991
description:
2025-11-18 03:09:56 dovecot_login authenticator failed for ([39.152.138.179]) [39.152.138.178]:50470: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 03:10:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<e6S9UthDuo1SczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-11-18 03:10:48 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:49006: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 03:11:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<wUrQU9hDAJTBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 03:10:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<VWeHUdhDrpcv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 03:10:27 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:64657: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 03:10:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<AdE+UthDFsstPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2025-11-18 03:10:07 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:33957: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:10:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QFlNUthD1tixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-11-18 03:10:48 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:43737: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.79.112
country_id: 1814991
description:
2025-11-18 03:12:06 dovecot_login authenticator failed for ([111.26.79.111]) [111.26.79.112]:54394: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-11-18 03:11:08 dovecot_login authenticator failed for ([61.72.59.106]) [61.72.59.106]:50543: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2025-11-18 03:11:17 dovecot_login authenticator failed for ([61.186.136.36]) [61.186.136.36]:55421: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-11-18 03:11:21 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:47349: 535 Incorrect authentication data (set_id=eleicoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.62.88
country_id: 1835841
description:
2025-11-18 03:11:24 dovecot_login authenticator failed for ([119.206.62.88]) [119.206.62.88]:47300: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2025-11-18 03:11:25 dovecot_login authenticator failed for (nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:46808: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bxraVdhDioCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.115.112.108
country_id: 6252001
description:
2025-11-18 03:12:38 dovecot_login authenticator failed for 146-115-112-108.s362.c3-0.wak-ubr1.sbo-wak.ma.cable.rcncustomer.com [146.115.112.108]:56230: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:13:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IzY5W9hD0J+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 03:12:24 dovecot_login authenticator failed for (User) [177.74.174.120]:58803: 535 Incorrect authentication data (set_id=santos@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 03:12:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<oeFCWdhDbKk+PIOL>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ilRxWdhDQpOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.205.242
country_id: 1814991
description:
2025-11-18 03:12:55 dovecot_login authenticator failed for ([218.4.205.242]) [218.4.205.242]:59870: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-11-18 03:13:01 dovecot_login authenticator failed for (dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:48728: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 03:13:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<u30eW9hDPMWElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 03:13:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<wGg2W9hD1q1CYSpH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 109.105.209.23
country_id: 2264397
description:
Nov 18 03:12:07 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=109.105.209.23, lip=200.150.196.245, TLS, session=<Rpn1V9hDoYZtadEX>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 03:12:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<u9ZrWNhDgLVn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 03:12:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<b3mjWdhDXIEO4dKR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.29
country_id: 1168579
description:
2025-11-18 03:13:08 dovecot_login authenticator failed for (29.92.zcomnetworks.com.pk) [103.148.92.29]:46436: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BcIGXdhDZqexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 03:13:36 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:64037: 535 Incorrect authentication data (set_id=info@ceramicamonallisa.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 03:13:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<UWHMXdhD6oA+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 03:13:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<9sl/XthDqqRrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-11-18 03:13:13 dovecot_login authenticator failed for 78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:55138: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.227.118
country_id: 1835841
description:
2025-11-18 03:13:47 dovecot_login authenticator failed for ([14.48.227.118]) [14.48.227.118]:43953: 535 Incorrect authentication data (set_id=maia@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-18 03:13:56 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:57724: 535 Incorrect authentication data (set_id=maia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.2.177
country_id: 1668284
description:
2025-11-18 03:14:08 dovecot_login authenticator failed for ([101.13.2.177]) [101.13.2.177]:54376: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 18 03:14:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dlmoveis.com.br>, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=<mfxoYNhDIuCqQMFo>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:14:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<p0ubYNhDDr2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
country_id: 1880251
description:
2025-11-18 03:14:37 dovecot_login authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:33132: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 03:14:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<5sT6YdhDrNaUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 03:14:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<TzP0YdhD0ujSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 03:15:11 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:61941: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 03:15:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<8coCY9hDlN13xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2025-11-18 03:15:30 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:52014: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ohAsZNhDGNSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 18 03:15:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<9L8JZNhD+ptbejg7>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:16:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AYzrZdhDDtuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.227.140.125
country_id: 2661886
description:
2025-11-18 03:15:51 dovecot_login authenticator failed for c-83-227-140-125.bbcust.telenor.se [83.227.140.125]:35598: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2025-11-18 03:16:12 dovecot_login authenticator failed for (217-29-30-135.saimanet.kg) [217.29.30.135]:39687: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.82.194
country_id: 1269750
description:
2025-11-18 03:16:31 dovecot_login authenticator failed for ([59.145.171.168]) [182.78.82.194]:58990: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bO25Z9hDtuKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-11-18 03:16:49 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:44990: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.115.122
country_id: 1814991
description:
2025-11-18 03:16:14 dovecot_login authenticator failed for ([111.26.115.121]) [111.26.115.122]:39382: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.50.202
country_id: 1814991
description:
2025-11-18 03:16:20 dovecot_login authenticator failed for ([219.144.50.202]) [219.144.50.202]:33529: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 03:16:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<gMRYZ9hDiLcv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 03:16:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<56THZ9hDgDSvfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 03:17:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<CyfLathDrJVAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.179
country_id: 1668284
description:
2025-11-18 03:17:30 dovecot_login authenticator failed for 111-70-49-179.emome-ip.hinet.net [111.70.49.179]:55094: 535 Incorrect authentication data (set_id=fernandabrum@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-11-18 03:17:41 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:49308: 535 Incorrect authentication data (set_id=fernandabrum)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 03:17:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<82/Aa9hD2pKl0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 03:17:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<hKvZathDDomB4kCN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<C3ZPa9hDeIqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 03:17:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<FxBoa9hDtI2d5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 03:17:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<Lz4+bNhDxtskMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-11-18 03:18:45 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:46019: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 03:19:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@f5assessoria.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<CVxrcNhDmuGkXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.245.138.2
country_id: 1269750
description:
2025-11-18 03:19:01 dovecot_login authenticator failed for ([117.245.138.2]) [117.245.138.2]:48965: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 03:19:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<s0qecNhDss0tPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 03:18:22 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:41852: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 03:18:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<12BobthDxo1w2eny>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:19:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zj6zcNhDtKixV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2vPhbthDOKGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.165
country_id: 3686110
description:
2025-11-18 03:18:35 dovecot_login authenticator failed for ([186.97.203.165]) [186.97.203.165]:49460: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 03:20:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<putCdNhDLK+UcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.74.67
country_id: 1835841
description:
2025-11-18 03:19:41 dovecot_login authenticator failed for ([121.147.74.67]) [121.147.74.67]:40974: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 03:19:57 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [pibtrindade]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 03:20:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<kVEEdNhD5Oto7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-11-18 03:19:51 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:36708: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
country_id: 1814991
description:
2025-11-18 03:19:17 dovecot_login authenticator failed for ([111.50.70.34]) [111.50.70.34]:50621: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<CHlxcthDxLSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.78
country_id: 2328926
description:
2025-11-18 03:21:00 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.78]:47831: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 03:20:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<qhcmddhDhKJA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.101
country_id: 1668284
description:
2025-11-18 03:20:28 dovecot_login authenticator failed for 110-25-104-101.adsl.fetnet.net [110.25.104.101]:56706: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 03:20:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<FA8md9hDXoykXF7M>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5ZUFdthDCsexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
country_id: 1814991
description:
2025-11-18 03:20:40 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:40017: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2025-11-18 03:20:52 dovecot_login authenticator failed for 81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:55768: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-18 03:20:59 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:65094: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 03:21:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<vUqXd9hDftCB4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.87
country_id: 3625428
description:
2025-11-18 03:20:11 dovecot_login authenticator failed for ([190.114.243.80]) [190.114.243.87]:34430: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 03:20:12 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [pibtrindade]


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 03:21:56 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [pibtrindade]


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 03:21:10 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [pibtrindade]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 03:21:21 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:51309: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 03:21:27 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [pibtrindade]


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<f8adedhDlN6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.25.183
country_id: 298795
description:
2025-11-18 03:21:11 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:58709: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 03:21:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<j0W/edhDzNWl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 03:21:59 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:64387: 535 Incorrect authentication data (set_id=info@jacgeneralcleaning.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:22:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<jRpne9hDqOaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 03:22:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@primiciapersianas.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<33yoe9hDwLGkXLll>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WfAsfdhDDIixV3kv>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.209.169
country_id: 2750405
description:
2025-11-18 03:22:47 H=([158.94.209.169]) [158.94.209.169]:53245 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=<sanjayexpprpll@gmail.com> rejected RCPT <contato@brilhometal.com.br>: "JunkMail rejected - ([158.94.209.169]) [158.94.209.169]:53245 is in an RBL: Listed by SBL, see https://check.spamhaus.org/sbl/query/SBL686264"


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 03:23:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<Os+xfthD6JqYNbyQ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<l0i/gNhDjpyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 03:23:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<lNmagdhDMtCKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-18 03:23:55 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:39576: 535 Incorrect authentication data (set_id=info@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 03:24:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fernandotonet.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<3YVjgthD9MqkXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.82.40.34
country_id: 1694008
description:
2025-11-18 03:24:04 dovecot_login authenticator failed for ([203.82.40.34]) [203.82.40.34]:34156: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 03:23:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<UxLTf9hDAiNo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 03:24:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<y3JngthDOIFns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 03:23:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<xIi0f9hDmoCGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.149
country_id: 1269750
description:
2025-11-18 03:24:48 dovecot_login authenticator failed for (nsg-corporate-149.229.187.122.airtel.in) [122.187.229.149]:35376: 535 Incorrect authentication data (set_id=info@deproi.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:25:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uUEchthDpL+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.236.186.137
country_id: 2017370
description:
2025-11-18 03:25:04 dovecot_login authenticator failed for (p186-137.samaralan.ru) [85.236.186.137]:43466: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 18 03:24:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<unSjg9hDNr0v+wDY>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<p9hZhNhDmLGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2025-11-18 03:24:54 dovecot_login authenticator failed for ([111.26.63.87]) [111.26.63.87]:48366: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.51.219.26
country_id: 3469034
description:
2025-11-18 03:24:54 dovecot_login authenticator failed for (187-51-219-26.customer.tdatabrasil.net.br) [187.51.219.26]:39058: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-11-18 03:25:05 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:40506: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-11-18 03:24:08 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:37372: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.187.2
country_id: 1269750
description:
2025-11-18 03:24:26 dovecot_login authenticator failed for (nsg-corporate-2.187.185.122.airtel.in) [122.185.187.2]:34918: 535 Incorrect authentication data (set_id=eleicoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 18 03:26:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<Pc/OidhD8IQrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 03:25:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<STvththDHq6YNbyQ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Qwnmh9hDGMixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.24.40
country_id: 2017370
description:
2025-11-18 03:25:41 dovecot_login authenticator failed for ([46.44.24.40]) [46.44.24.40]:55357: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-11-18 03:25:56 dovecot_login authenticator failed for ([152.52.246.178]) [152.52.246.178]:56038: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.135.6.10
country_id: 1814991
description:
2025-11-18 03:26:25 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:41066: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BpB6i9hDft6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 03:27:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<uKcdjdhDjrhAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.95.250
country_id: 1814991
description:
2025-11-18 03:26:38 dovecot_login authenticator failed for ([113.140.95.250]) [113.140.95.250]:59904: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 03:26:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<kSBfjNhDgKWkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 03:26:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<MYVUjNhDq5x3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-18 03:26:17 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:55327: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.29.137.49
country_id: 1814991
description:
2025-11-18 03:26:19 dovecot_login authenticator failed for ([119.29.137.49]) [119.29.137.49]:59974: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 03:26:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<mDtIi9hDauWd5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 18 03:26:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<5G+pi9hDDMGWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.79.146.1
country_id: 2623032
description:
2025-11-18 03:28:00 dovecot_login authenticator failed for (062079146001.mbb.telenor.dk) [62.79.146.1]:44248: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.0.90
country_id: 2017370
description:
2025-11-18 03:28:04 dovecot_login authenticator failed for ([213.234.0.90]) [213.234.0.90]:40826: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<i/YVj9hDfIOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-18 03:27:34 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:54909: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 03:27:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@primiciapersianas.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<+SVVkNhDFpd2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.127.14
country_id: 1269750
description:
2025-11-18 03:27:59 dovecot_login authenticator failed for (abts-north-dynamic-014.127.163.122.airtelbroadband.in) [122.163.127.14]:31860: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.16.40.3
country_id: 1814991
description:
2025-11-18 03:27:47 dovecot_login authenticator failed for ([110.16.40.3]) [110.16.40.3]:32202: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2025-11-18 03:27:07 dovecot_login authenticator failed for 111-70-32-10.emome-ip.hinet.net [111.70.32.10]:38815: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-11-18 03:27:17 dovecot_login authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:56866: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.33.154
country_id: 1562822
description:
2025-11-18 03:27:22 dovecot_login authenticator failed for (nhavuivn.com) [210.245.33.154]:48896: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.76.17
country_id: 2077456
description:
2025-11-18 03:27:30 dovecot_login authenticator failed for ([123.209.76.17]) [123.209.76.17]:40470: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:28:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bMeskthD7pixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2025-11-18 03:28:56 dovecot_login authenticator failed for ([175.206.113.91]) [175.206.113.91]:53706: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 03:28:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<RyyGkthDKK87GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-11-18 03:28:16 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:34011: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.221.104
country_id: 1814991
description:
2025-11-18 03:28:18 dovecot_login authenticator failed for ([221.10.221.104]) [221.10.221.104]:50594: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 03:28:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<UI0OkthDyqhxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2025-11-18 03:28:31 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:46678: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2025-11-18 03:28:42 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:50274: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 03:28:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=</QjSk9hDzJwXXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:29:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</G1rlNhDOKWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 03:28:14 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64598: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 03:29:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<azBrldhDOtUtPZWl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 71.6.134.233
country_id: 6252001
description:
Nov 18 03:29:51 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=71.6.134.233, lip=200.150.196.245, TLS, session=<Nmpfl9hDks5HBobp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.5
country_id: 1668284
description:
2025-11-18 03:29:54 dovecot_login authenticator failed for 111-70-32-5.emome-ip.hinet.net [111.70.32.5]:55373: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 03:29:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<A91MldhDtqeKxX03>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rPk1lthD7q6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-11-18 03:29:38 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:35050: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 03:29:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<aILplthDetJA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 18 03:29:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<rq4al9hDep+nR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 03:30:48 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:16573: 535 Incorrect authentication data (set_id=info@ufadville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 03:30:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<P+qEmNhDANpSnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 18 03:30:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<TGWKmNhDFOovT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 03:30:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<LFFAmdhDEtQtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.49
country_id: 1668284
description:
2025-11-18 03:30:27 dovecot_login authenticator failed for 221-120-4-49.emome-ip.hinet.net [221.120.4.49]:54403: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 03:30:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<LE99mdhDZtYI2Cjk>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KmXKmdhDMsaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.149.161.131
country_id: 6252001
description:
2025-11-18 03:31:48 dovecot_login authenticator failed for c-50-149-161-131.hsd1.tn.comcast.net [50.149.161.131]:62173: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.122.20
country_id: 2017370
description:
2025-11-18 03:32:06 dovecot_login authenticator failed for ([94.102.122.20]) [94.102.122.20]:58316: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 18 03:31:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<Bc7om9hD9M0zTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.67.146
country_id: 2017370
description:
2025-11-18 03:31:35 dovecot_login authenticator failed for ([31.173.67.146]) [31.173.67.146]:44078: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 03:31:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<9PnTnNhDwqd9gnHM>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<d1RZndhD1tSxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:32:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Rfwsn9hDsuOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 03:31:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<5S8PnNhDHOdxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2025-11-18 03:31:13 dovecot_login authenticator failed for ([222.117.0.253]) [222.117.0.253]:46080: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 03:32:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pousadarincaoalegre.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<A/8joNhDONBzR+4E>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<oa/4oNhDQOuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 03:32:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<RV4aodhDdnKvfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 03:32:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<G5UsothDqJmElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 03:33:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<JHPQpdhDusCP9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.173.138.250
country_id: 1814991
description:
2025-11-18 03:34:03 dovecot_login authenticator failed for ([222.173.138.250]) [222.173.138.250]:41374: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 03:33:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<l1Jmo9hDbP2nYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2025-11-18 03:33:22 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:54601: 535 Incorrect authentication data (set_id=mariacarla@transoltransportes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5QiDpNhDKJOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.203.179.228
country_id: 1814991
description:
2025-11-18 03:33:39 dovecot_login authenticator failed for ([218.203.179.228]) [218.203.179.228]:60088: 535 Incorrect authentication data (set_id=mariacarla)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yaAbqNhDPKmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.149.120.254
country_id: 6252001
description:
2025-11-18 03:34:52 dovecot_login authenticator failed for ([24.149.120.254]) [24.149.120.254]:45004: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:35:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<75HrqdhD6rGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.69.160
country_id: 1814991
description:
2025-11-18 03:35:06 dovecot_login authenticator failed for ([111.26.69.160]) [111.26.69.160]:54630: 535 Incorrect authentication data (set_id=info@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2025-11-18 03:34:17 dovecot_login authenticator failed for 111-70-32-10.emome-ip.hinet.net [111.70.32.10]:46786: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-11-18 03:34:22 dovecot_login authenticator failed for ([61.2.44.54]) [61.2.44.54]:52184: 535 Incorrect authentication data (set_id=info@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.204.32
country_id: 1814991
description:
2025-11-18 03:35:28 dovecot_login authenticator failed for ([220.180.204.32]) [220.180.204.32]:53738: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3Suvq9hD9rmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2025-11-18 03:35:35 dovecot_login authenticator failed for ([186.201.32.242]) [177.174.95.245]:57344: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.144.52.96
country_id: 660013
description:
2025-11-18 03:36:50 dovecot_plain authenticator failed for (hq76b7pu078bo3b5zh9xz0awqw) [45.144.52.96]:49850: 535 Incorrect authentication data (set_id=design@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 03:36:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@alcantaraemonteiro.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<vXtysNhDFoB2wSaf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IEdFr9hD0tmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 03:36:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<I1Y3r9hDgIB9gnHM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 03:36:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<sOPIr9hD2rAnaoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 03:36:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<0EBUsNhD9N8kMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.237.249
country_id: 1835841
description:
2025-11-18 03:36:16 dovecot_login authenticator failed for ([222.99.237.249]) [222.99.237.249]:40849: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 03:36:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<CfD5rthDOs4rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 03:36:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<NaoGsNhDxIpvAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
country_id: 2017370
description:
2025-11-18 03:37:31 dovecot_login authenticator failed for (dialup-solikamsk-212.120.163.110.uralcom.com) [212.120.163.110]:49469: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 03:37:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<icgds9hDLopSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2025-11-18 03:37:51 dovecot_login authenticator failed for 111-70-32-10.emome-ip.hinet.net [111.70.32.10]:49865: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 03:37:57 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52170: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:38:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NjiYtNhDnIqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.196.79
country_id: 290557
description:
2025-11-18 03:37:12 dovecot_login authenticator failed for ([5.30.196.79]) [5.30.196.79]:48943: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.100.124.153
country_id: 2017370
description:
2025-11-18 03:37:15 dovecot_login authenticator failed for ([176.100.124.153]) [176.100.124.153]:51906: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 03:37:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<EjKqsthDTp+UcQQF>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<v3LZsthDDIKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.78.13.13
country_id: 732800
description:
2025-11-18 03:37:40 dovecot_login authenticator failed for inkas.networx-bg.com [77.78.13.13]:38020: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-11-18 03:38:28 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:20075: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<wYRntthDRp+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 03:38:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@oabsjp.org.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<EGUYt9hDCpCkXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.14.2
country_id: 1668284
description:
2025-11-18 03:38:45 dovecot_login authenticator failed for ([58.115.14.2]) [58.115.14.2]:57072: 535 Incorrect authentication data (set_id=presidencia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-11-18 03:38:48 dovecot_login authenticator failed for ([196.190.220.168]) [196.190.220.168]:48734: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 03:38:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<8NG4t9hDJO2B4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
country_id: 1835841
description:
2025-11-18 03:38:12 dovecot_login authenticator failed for ([121.135.188.125]) [121.135.188.125]:35788: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-18 03:38:15 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:49133: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 03:38:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<LMyhtdhDRtwv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2025-11-18 03:38:22 dovecot_login authenticator failed for ([211.169.212.206]) [211.169.212.206]:64492: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-11-18 03:38:41 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:35416: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 03:38:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<W0mWt9hDtoUnaoFh>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:39:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<G+0DuthDLLGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 03:39:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<QP6luthDZrpn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 03:39:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<SbqNuNhDbMFCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 03:39:25 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51789: 535 Incorrect authentication data (set_id=nfe2@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-11-18 03:39:31 dovecot_login authenticator failed for ([65.20.250.163]) [65.20.250.163]:53786: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-11-18 03:41:07 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:52130: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.70.149.210
country_id: 1814991
description:
2025-11-18 03:40:10 dovecot_login authenticator failed for ([223.70.149.210]) [223.70.149.210]:48989: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gwSTvdhDWMqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.177.110
country_id: 1835841
description:
2025-11-18 03:41:00 dovecot_login authenticator failed for ([218.154.54.1]) [222.108.177.110]:59903: 535 Incorrect authentication data (set_id=info@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.50
country_id: 2017370
description:
2025-11-18 03:41:00 dovecot_login authenticator failed for ([89.175.253.50]) [89.175.253.50]:44686: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 18 03:40:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<QgRlvdhDlCkkMrGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.19
country_id: 2186224
description:
2025-11-18 03:40:59 dovecot_login authenticator failed for ([121.73.163.19]) [121.73.163.19]:56108: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2025-11-18 03:40:41 dovecot_login authenticator failed for (23-30-11-253-static.hfc.comcastbusiness.net) [23.30.11.253]:48277: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 03:40:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<myjxvthDuqdns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:41:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<H21gv9hDvNGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 03:40:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<e0VvvNhDBZp3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-18 03:40:21 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:34822: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.236.187.43
country_id: 2017370
description:
2025-11-18 03:40:31 dovecot_login authenticator failed for (p187-43.samaralan.ru) [85.236.187.43]:38336: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.31.138.38
country_id: 3469034
description:
2025-11-18 03:41:32 dovecot_plain authenticator failed for 189-31-138-38.user3p.v-tal.net.br ([192.168.56.1]) [189.31.138.38]:59972: 535 Incorrect authentication data (set_id=thalisson.mota@fourps.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-11-18 03:41:10 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:57358: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-18 03:41:21 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:48336: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-18 03:41:29 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:37204: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.121
country_id: 3996063
description:
2025-11-18 03:41:30 dovecot_login authenticator failed for (201.173.216.121-clientes-izzi.mx) [201.173.216.121]:59212: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ijEnwdhDxOCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.118
country_id: 1269750
description:
2025-11-18 03:41:19 dovecot_login authenticator failed for ([128.185.223.220]) [27.123.111.118]:51934: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.69.133.54
country_id: 1814991
description:
2025-11-18 03:41:46 dovecot_login authenticator failed for ([183.69.133.54]) [183.69.133.54]:6239: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2025-11-18 03:41:47 dovecot_login authenticator failed for ([101.13.5.34]) [101.13.5.34]:43306: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 03:41:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<b0BKwthDTm+nYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 03:42:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<BzTRwthDmolvAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.26.3
country_id: 3996063
description:
2025-11-18 03:42:10 dovecot_login authenticator failed for (201.172.26.3-clientes-izzi.mx) [201.172.26.3]:55200: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.225.142.58
country_id: 6251999
description:
2025-11-18 03:42:19 dovecot_plain authenticator failed for (4ONOTEBOOK-rHiE) [104.225.142.58]:21523: 535 Incorrect authentication data (set_id=opec@1075fm.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Ctq8xNhDEIexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.185.98.251
country_id: 6252001
description:
2025-11-18 03:42:08 dovecot_login authenticator failed for 47-185-98-251.fdr03.kllr.tx.ip.frontiernet.net [47.185.98.251]:13531: 535 Incorrect authentication data (set_id=lucas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 03:42:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<H4W7w9hDnNSGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.133
country_id: 3996063
description:
2025-11-18 03:42:18 dovecot_login authenticator failed for (201.173.216.133-clientes-izzi.mx) [201.173.216.133]:53804: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.94.211
country_id: 1880251
description:
2025-11-18 03:42:48 dovecot_login authenticator failed for (223-25-94-211.myrepublic.com.sg) [223.25.94.211]:64088: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 18 03:43:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<EoxixthD4psIiXsk>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:44:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SXkbythDvKmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.135
country_id: 2017370
description:
2025-11-18 03:44:07 dovecot_login authenticator failed for ([178.178.194.135]) [178.178.194.135]:39706: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 18 03:43:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=</mnsx9hDw8S317Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 03:43:34 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:62225: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 03:43:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fernandotonet.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<swBpyNhDtN12wSaf>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<enRQyNhD0puxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.142.132.9
country_id: 3175395
description:
2025-11-18 03:43:50 dovecot_login authenticator failed for ([45.142.132.9]) [45.142.132.9]:49860: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 03:43:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<h2tTydhDAp7Bl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.39
country_id: 1814991
description:
2025-11-18 03:43:54 dovecot_login authenticator failed for ([111.26.62.38]) [111.26.62.39]:33176: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 03:43:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<HABCx9hDBZB3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2025-11-18 03:43:28 dovecot_login authenticator failed for ([220.67.139.254]) [221.145.5.14]:53504: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 18 03:43:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@prolip.com.br>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<G0ICyNhD3t+iAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.81.209.76
country_id: 2017370
description:
2025-11-18 03:44:40 dovecot_login authenticator failed for ([78.81.209.76]) [78.81.209.76]:55655: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 03:44:40 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64139: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 03:45:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=</K99zdhDuo+l0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2025-11-18 03:45:07 dovecot_login authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:44668: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2025-11-18 03:44:16 dovecot_login authenticator failed for ([218.22.187.69]) [218.22.187.66]:51150: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.233.83.90
country_id: 1814991
description:
2025-11-18 03:44:25 dovecot_login authenticator failed for ([116.233.83.90]) [116.233.83.90]:58552: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.222.124.164
country_id: 1814991
description:
2025-11-18 03:44:34 dovecot_login authenticator failed for (164.124.222.222.broad.lf.he.dynamic.163data.com.cn) [222.222.124.164]:42737: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 03:44:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<LB1qythDhI+P9IUv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<g7zhy9hDfrKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.31.17.131
country_id: 3175395
description:
2025-11-18 03:44:58 dovecot_login authenticator failed for ([87.31.17.131]) [87.31.17.131]:38404: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.89
country_id: 1814991
description:
2025-11-18 03:46:05 dovecot_login authenticator failed for ([111.26.63.88]) [111.26.63.89]:32822: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-18 03:45:10 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:59920: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.115
country_id: 1814991
description:
2025-11-18 03:45:11 dovecot_login authenticator failed for ([111.26.106.115]) [111.26.106.115]:37898: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.154.166
country_id: 1814991
description:
2025-11-18 03:45:22 dovecot_login authenticator failed for ([122.224.154.166]) [122.224.154.166]:35604: 535 Incorrect authentication data (set_id=flavio.oliveira)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Y+Jxz9hDesmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2025-11-18 03:45:48 dovecot_login authenticator failed for ([112.161.26.125]) [112.161.26.125]:42942: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.167.203.56
country_id: 1814991
description:
2025-11-18 03:46:25 dovecot_login authenticator failed for ([223.167.203.56]) [223.167.203.56]:4231: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-18 03:46:36 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:36432: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 03:46:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<quRE09hDtJlSnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 03:46:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<z8wd1NhDdtFns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:47:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dVXU1NhDkuqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 03:46:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<4AL/0dhDmpJrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 03:46:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<HtIE0thDSIoI1et7>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ciT/0thDZtuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.144.131.25
country_id: 1814991
description:
Nov 18 03:47:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@profetizandoasmulheres.com.br>, method=PLAIN, rip=122.144.131.25, lip=200.150.196.245, session=<LUjF09hDZOh6kIMZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 03:47:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<RbWa19hDxL5A44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2025-11-18 03:47:13 dovecot_login authenticator failed for (217-29-30-135.saimanet.kg) [217.29.30.135]:58497: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 03:47:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<mwLY1NhDpMdzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 03:47:24 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:56689: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 03:47:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<sq5b1thD4s9n9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FY+T1thDYoSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 03:47:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<cI3m1thD3Nyl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-11-18 03:47:08 dovecot_login authenticator failed for ([182.95.24.209]) [182.95.57.158]:42790: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-18 03:47:39 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:44992: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.30.253
country_id: 1814991
description:
2025-11-18 03:47:52 dovecot_login authenticator failed for ([112.27.30.253]) [112.27.30.253]:52313: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 03:48:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<EK0s2dhDXJyYNbyQ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VtYp2thD7JuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
country_id: 1814991
description:
2025-11-18 03:48:34 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:41940: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.141
country_id: 1819730
description:
2025-11-18 03:48:51 dovecot_login authenticator failed for (223-197-145-141.static.imsbiz.com) [223.197.145.141]:60077: 535 Incorrect authentication data (set_id=info@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-11-18 03:49:24 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:60790: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 03:49:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<Jzhv3dhDfLAv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-18 03:50:06 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:57784: 535 Incorrect authentication data (set_id=info@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.182
country_id: 1668284
description:
2025-11-18 03:49:48 dovecot_login authenticator failed for 111-70-49-182.emome-ip.hinet.net [111.70.49.182]:39805: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:50:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lmeL39hDMryxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.87.177.252
country_id: 6252001
description:
2025-11-18 03:50:03 dovecot_login authenticator failed for (mail.jimsmithcenters.com) [38.87.177.252]:60270: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 03:49:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<lmwF3dhDdqpCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.61
country_id: 2017370
description:
2025-11-18 03:49:24 dovecot_login authenticator failed for ([178.178.222.61]) [178.178.222.61]:44802: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:49:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XovG3dhDLLWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 03:49:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=</vVu3thDhNRSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 18 03:50:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<RkVw4NhDlN+dQi/y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.123
country_id: 1819730
description:
2025-11-18 03:50:23 dovecot_login authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:62451: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BaVP4dhD/MSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 03:50:37 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:58529: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.126.65.71
country_id: 6251999
description:
2025-11-18 03:50:49 dovecot_login authenticator failed for ([216.126.65.71]) [216.126.65.71]:41877: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 03:50:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<1Xxz4NhDDp9ns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-18 03:50:18 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:43735: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.131.107
country_id: 6252001
description:
[2025-11-18 03:51:45 -0300] info [whostmgrd] 124.198.131.107 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 03:51:14 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52331: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 03:51:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<4dIy5NhD0tiElIx5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Sqjj5NhDXtuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.77.157
country_id: 1814991
description:
2025-11-18 03:51:38 dovecot_login authenticator failed for ([223.210.0.110]) [111.48.77.157]:15307: 535 Incorrect authentication data (set_id=presidencia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.19
country_id: 2186224
description:
2025-11-18 03:53:06 dovecot_login authenticator failed for ([121.73.163.19]) [121.73.163.19]:47700: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 03:52:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<7fxt59hDpJ8tPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 03:52:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<9UVb6NhDSpFn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 03:52:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<7hPK6NhDdsYrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 03:52:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<G2IS6dhDcKzBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 03:52:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<uVIK6dhDoIjSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
country_id: 1835841
description:
2025-11-18 03:52:59 dovecot_login authenticator failed for ([211.253.10.61]) [211.253.10.61]:55537: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:53:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EF5C6thDNoqxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Qvp36NhDWIOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.100.39.180
country_id: 2017370
description:
2025-11-18 03:52:44 dovecot_login authenticator failed for ([92.100.39.180]) [92.100.39.180]:53790: 535 Incorrect authentication data (set_id=info@calcautomacao.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 03:52:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<Z1eL6dhDRLGB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 03:53:03 dovecot_login authenticator failed for (User) [177.74.174.120]:59609: 535 Incorrect authentication data (set_id=santos@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.34
country_id: 3996063
description:
2025-11-18 03:53:35 dovecot_login authenticator failed for (201.173.97.34-clientes-izzi.mx) [201.173.97.34]:38590: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.199.146.204
country_id: 192950
description:
2025-11-18 03:53:38 dovecot_login authenticator failed for (ADMIN) [217.199.146.204]:56863: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 03:53:14 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:63545: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 18 03:53:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<rZoZ69hDSLGnR+bm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-18 03:53:21 dovecot_login authenticator failed for ([128.185.224.250]) [125.20.251.66]:56448: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 03:53:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<XOf27NhDZpIO4dKR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.154.211
country_id: 1861060
description:
2025-11-18 03:54:04 dovecot_login authenticator failed for p83212-obmd01.osaka.ocn.ne.jp [180.7.154.211]:37744: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 03:53:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<WfY569hDKK9w2eny>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NkwR7NhDGpixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.93.213
country_id: 1668284
description:
2025-11-18 03:53:24 dovecot_login authenticator failed for 110-25-93-213.adsl.fetnet.net [110.25.93.213]:53134: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2025-11-18 03:53:33 dovecot_login authenticator failed for ([121.134.31.193]) [121.134.31.193]:40938: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 03:53:09 dovecot_login authenticator failed for (User) [177.74.174.120]:59609: 535 Incorrect authentication data (set_id=santos@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.212.92
country_id: 2017370
description:
2025-11-18 03:53:20 dovecot_login authenticator failed for broadband-178-140-212-92.ip.moscow.rt.ru [178.140.212.92]:56750: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-18 03:54:22 dovecot_login authenticator failed for ([152.52.234.134]) [125.20.245.182]:43428: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2025-11-18 03:54:32 dovecot_login authenticator failed for ([103.146.233.200]) [103.146.233.200]:52794: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.101.69
country_id: 3144096
description:
2025-11-18 03:55:01 dovecot_login authenticator failed for (cm-46.212.101.69.get.no) [46.212.101.69]:59311: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 03:54:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<C3Ya7thDOrdrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 03:54:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<WwtK79hDuL0XXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3NGl79hD9KexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 18 03:54:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<eLMA8NhDLJQrZDwA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.137.31.134
country_id: 1814991
description:
2025-11-18 03:54:47 dovecot_login authenticator failed for ([113.137.31.134]) [113.137.31.134]:52593: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.136.183
country_id: 99237
description:
2025-11-18 03:54:49 dovecot_login authenticator failed for ([65.20.136.183]) [65.20.136.183]:32847: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.134.56
country_id: 3374766
description:
2025-11-18 03:55:02 dovecot_login authenticator failed for ([197.255.134.56]) [197.255.134.56]:46401: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 18 03:55:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<wpqM89hDWOBbejg7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 03:55:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<omKb9NhDKME+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2025-11-18 03:56:02 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:53720: 535 Incorrect authentication data (set_id=vinicius.costa@deproi.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:56:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<wnkB9dhDLMaxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lRQz89hDrL6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 03:55:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<+EhI89hDGsov+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 03:55:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<C1Og89hDbLid5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 03:55:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<+QGV9NhDmtxCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.121.99
country_id: 1814991
description:
2025-11-18 03:56:35 dovecot_login authenticator failed for ([111.53.121.99]) [111.53.121.99]:52252: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 03:56:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=</G3/9thDcJ1AF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.146.46
country_id: 3469034
description:
2025-11-18 03:56:53 dovecot_login authenticator failed for ([189.80.204.17]) [189.80.146.46]:39935: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 03:57:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<bSlM+NhDqIHBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.170.40.231
country_id: 2017370
description:
2025-11-18 03:56:17 dovecot_login authenticator failed for ([188.170.40.231]) [188.170.40.231]:58192: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 03:56:25 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:59615: 535 Incorrect authentication data (set_id=postamster@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FVDD9thDXtSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2025-11-18 03:56:11 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:54510: 535 Incorrect authentication data (set_id=vinicius.costa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.93.84
country_id: 1269750
description:
2025-11-18 03:56:32 dovecot_login authenticator failed for ([152.52.93.82]) [152.52.93.84]:10400: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:57:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xQ9j+thDOuixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 03:57:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@toromartelinho.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<f0S59dhDEsVzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.249
country_id: 1819730
description:
2025-11-18 03:58:00 dovecot_login authenticator failed for 249.151.48.116.static.netvigator.com [116.48.151.249]:63824: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 03:57:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<D5He+NhDENfSchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 03:57:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@f5assessoria.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<15BP+dhDmOF2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.171.186
country_id: 1814991
description:
2025-11-18 03:58:47 dovecot_login authenticator failed for ([218.75.123.109]) [183.247.171.186]:36675: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-11-18 03:58:12 dovecot_login authenticator failed for ([46.8.245.34]) [46.8.245.34]:59312: 535 Incorrect authentication data (set_id=flavio.oliveira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-11-18 03:58:15 dovecot_login authenticator failed for ([125.19.165.242]) [125.19.188.98]:57372: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.232.11
country_id: 1814991
description:
2025-11-18 03:59:06 dovecot_login authenticator failed for ([27.45.232.11]) [27.45.232.11]:43067: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.141.56.185
country_id: 1814991
description:
2025-11-18 03:58:46 dovecot_login authenticator failed for ([211.141.56.184]) [211.141.56.185]:40686: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.253.86
country_id: 1269750
description:
2025-11-18 03:58:10 dovecot_login authenticator failed for ([125.20.253.86]) [125.20.253.86]:55574: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:59:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<V6G4/9hDbpyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.33.227
country_id: 1668284
description:
2025-11-18 03:58:36 dovecot_login authenticator failed for 111-70-33-227.emome-ip.hinet.net [111.70.33.227]:55078: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 03:58:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<M4W9/thDcsyUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 03:58:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<yE7x/thDYnVo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.31
country_id: 3996063
description:
2025-11-18 03:59:03 dovecot_login authenticator failed for ([201.173.250.31]) [201.173.250.31]:34491: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.73.130
country_id: 1814991
description:
2025-11-18 03:59:06 dovecot_login authenticator failed for ([111.50.73.130]) [111.50.73.130]:60052: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.122.211.212
country_id: 1814991
description:
2025-11-18 03:58:21 dovecot_login authenticator failed for (brilhometal.com.br) [111.122.211.212]:27932: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</WPp/dhDLo2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 03:59:14 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51630: 535 Incorrect authentication data (set_id=contato@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.15.69
country_id: 3469034
description:
2025-11-18 03:59:15 dovecot_login authenticator failed for (177-174-15-89.user.vivozap.com.br) [177.174.15.69]:49798: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 03:59:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<GHa7ANlDRul3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 18 03:59:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=<zBTPAtlD5JmqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 03:59:18 dovecot_login authenticator failed for (User) [177.74.174.120]:62159: 535 Incorrect authentication data (set_id=santos@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-18 03:59:19 dovecot_login authenticator failed for ([125.19.82.193]) [182.95.115.70]:34336: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-18 03:59:30 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:35240: 535 Incorrect authentication data (set_id=faturamento)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 03:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uh2JAdlDAqSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.205.20.70
country_id: 6251999
description:
2025-11-18 03:59:41 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:56876: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<meQZBdlDZLuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 04:00:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<OP6CBdlDZK4tPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-11-18 04:00:45 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:42413: 535 Incorrect authentication data (set_id=cpanel)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 04:01:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@highqualityautoparts.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<ttyuBtlDhrs+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.237.108
country_id: 1814991
description:
2025-11-18 04:00:17 dovecot_login authenticator failed for ([218.22.237.108]) [218.22.237.108]:33602: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 04:00:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<LunyA9lD6Oel0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 04:00:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<vKTjBNlD1J+B4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 04:01:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<8AqVCNlDkg2vfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
country_id: 1814991
description:
2025-11-18 04:01:49 dovecot_login authenticator failed for ([113.219.177.95]) [113.219.177.95]:36886: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:02:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6rNyCtlDrtqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 04:01:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=</Di3CdlDqJ6YNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-11-18 04:02:05 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:54667: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 04:01:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=</TQwB9lDTqpA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 04:01:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<qE51B9lDWOGkXF7M>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<l+alCNlD6MqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 04:01:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<qFkZCdlDLpmB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 04:01:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<GiyLCdlDTuUkMrBu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 18 04:02:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<E+YZDNlDyoIv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 04:02:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<zbnTCtlD0MFo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 04:02:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<c4jvC9lDdIKl0xnK>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PJZBDNlDOOOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.31
country_id: 3996063
description:
2025-11-18 04:02:43 dovecot_login authenticator failed for (201.173.250.31-clientes-izzi.mx) [201.173.250.31]:45152: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 18 04:02:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<VpTxDNlDcLt57bKF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.151.6
country_id: 2661886
description:
2025-11-18 04:02:14 dovecot_login authenticator failed for h188-122-151-6.cust.bredband2.com [188.122.151.6]:37252: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 47.76.240.198
country_id: 1819730
description:
Nov 18 04:03:10 hosting pure-ftpd: (?@47.76.240.198) [WARNING] Authentication failed for user [iemif]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 04:03:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<d3WyDtlDzPCKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.191.70.126
country_id: 6252001
description:
2025-11-18 04:03:17 dovecot_login authenticator failed for pool-71-191-70-126.washdc.fios.verizon.net [71.191.70.126]:60425: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.155.199.176
country_id: 3469034
description:
Nov 18 04:03:28 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=<dTKOD9lDHMmxm8ew>


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 47.76.240.198
country_id: 1819730
description:
Nov 18 04:03:43 hosting pure-ftpd: (?@47.76.240.198) [WARNING] Authentication failed for user [iemif]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 173.25.186.130
country_id: 6252001
description:
Nov 18 04:03:47 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@maringasoldas.com.br>, method=PLAIN, rip=173.25.186.130, lip=200.150.196.245, TLS, session=<3V+kD9lDBOytGbqC>


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 47.76.240.198
country_id: 1819730
description:
Nov 18 04:04:02 hosting pure-ftpd: (?@47.76.240.198) [WARNING] Authentication failed for user [iemif]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:03:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+9bXD9lD9IuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Nov 18 04:03:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=<ChXiD9lDso7BHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 04:03:08 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51426: 535 Incorrect authentication data (set_id=curitiba@asscar.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 04:03:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<BpjlD9lDKNWUcQQF>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KE1qE9lDGKGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 04:04:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<4b//EdlDiM+YNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 04:04:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<KvXSEtlDjr1ns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 213.167.45.70
country_id: 2017370
description:
Nov 18 04:04:32 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=213.167.45.70, lip=200.150.196.245, TLS, session=<P35ZEtlDTNvVpy1G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.61
country_id: 2186224
description:
2025-11-18 04:04:44 dovecot_login authenticator failed for ([121.73.163.61]) [121.73.163.61]:46556: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:05:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XIsnFdlDFqmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.221.208.214
country_id: 1814991
description:
2025-11-18 04:04:13 dovecot_login authenticator failed for ([58.221.208.214]) [58.221.208.214]:46708: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 04:04:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<lePYE9lDBsid5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.128.93.196
country_id: 2017370
description:
2025-11-18 04:04:47 dovecot_login authenticator failed for (l5-128-93-196.novotelecom.ru) [5.128.93.196]:38996: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.103.53.44
country_id: 1269750
description:
Nov 18 04:04:13 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=103.103.53.44, lip=200.150.196.245, session=<T5AJEtlD1o5nZzUs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 04:04:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<VtIFEtlDXNKGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2025-11-18 04:04:21 dovecot_login authenticator failed for ([182.78.87.2]) [182.78.87.2]:39782: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AZfyFtlDzLCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 04:05:20 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51965: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 18 04:05:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@huboperacoes.com>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<2g2bFtlDQpUrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 04:06:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<t8JwGdlD4LdAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 04:06:16 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51548: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.85.66
country_id: 3469034
description:
2025-11-18 04:06:25 dovecot_login authenticator failed for 179-189-85-66.goldnettelecom.com.br [179.189.85.66]:37466: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.82.65.48
country_id: 2077456
description:
[2025-11-18 04:06:27 -0300] info [cpaneld] 103.82.65.48 - 1075fm "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<reKRGtlD/sexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 04:06:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@oabsjp.org.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<B2X1G9lDmOZ2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-11-18 04:06:57 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:41971: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.25.161
country_id: 1668284
description:
2025-11-18 04:07:49 dovecot_login authenticator failed for 111-70-25-161.emome-ip.hinet.net [111.70.25.161]:41678: 535 Incorrect authentication data (set_id=rsimoesdiretoria@hipercesta.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 04:07:54 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:49906: 535 Incorrect authentication data (set_id=admin@jacgeneralcleaning.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
country_id: 1668284
description:
2025-11-18 04:07:58 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:37544: 535 Incorrect authentication data (set_id=rsimoesdiretoria)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:08:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZQPpH9lDAOWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 04:07:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<la/ZHNlDDLqkXF7M>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3AshHtlD3N2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 04:08:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<8OR4ItlD4M+KxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 04:08:52 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:56604: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 04:08:29 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51436: 535 Incorrect authentication data (set_id=conferencia2019@profetizandoasmulheres.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fZ+2IdlDVIOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 18 04:08:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<9cvwIdlDGt+WXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 04:10:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<twISJ9lDeKII2Cjk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-11-18 04:09:16 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:53970: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<GQtAJdlDWJWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.121.175.167
country_id: 1835841
description:
2025-11-18 04:09:34 dovecot_login authenticator failed for ([58.121.175.167]) [58.121.175.167]:50330: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.43.5.222
country_id: 357994
description:
2025-11-18 04:09:37 dovecot_login authenticator failed for ([195.43.5.222]) [195.43.5.222]:60494: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:09:51 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:49786: 535 Incorrect authentication data (set_id=info@conut.org.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.62
country_id: 1814991
description:
2025-11-18 04:10:02 dovecot_login authenticator failed for ([183.220.243.62]) [183.220.243.62]:55614: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 04:10:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<M+R2KdlD7vanYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 04:11:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<WLeGKtlDeLotPZWl>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:10:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JBfhKNlDAK+xV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:11:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HcmiKtlDwraxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 18 04:10:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<fJaiJ9lD9s0zTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 04:10:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<ZoKQKNlDaMZA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.117.131
country_id: 3144096
description:
2025-11-18 04:10:37 dovecot_login authenticator failed for (cm-46.212.117.131.get.no) [46.212.117.131]:45821: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 04:10:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<12iOKdlDAJs7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.244.98.11
country_id: 1814991
description:
2025-11-18 04:10:53 dovecot_login authenticator failed for (210.241.51.119.adsl-pool.jlccptt.net.cn) [58.244.98.11]:58062: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:10:17 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:27513: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.124.225.159
country_id: 2017370
description:
2025-11-18 04:10:56 dovecot_login authenticator failed for (host-94.124.225.159.gascom.net.ru) [94.124.225.159]:37678: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 04:10:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<vi09KtlDRah3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 04:12:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<mq1VLtlDXs8tPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 04:11:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<d8TWKtlDZKmElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 04:11:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<j8cbK9lDysNxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2025-11-18 04:11:15 dovecot_login authenticator failed for ([183.104.220.84]) [183.104.220.84]:34762: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-18 04:11:27 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:49238: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:11:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<P690LNlDwMaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
country_id: 1814991
description:
2025-11-18 04:11:48 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:36860: 535 Incorrect authentication data (set_id=info@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.16.91
country_id: 1880251
description:
2025-11-18 04:12:46 dovecot_login authenticator failed for (91.16.156.202.starhub.net.sg) [202.156.16.91]:53075: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
country_id: 1835841
description:
2025-11-18 04:13:06 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:37174: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 04:12:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<xqEPL9lDJMB9gnHM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<pxsCMNlDrtmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.7.79.146
country_id: 1835841
description:
2025-11-18 04:13:18 dovecot_login authenticator failed for ([175.226.126.177]) [59.7.79.146]:39428: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.3
country_id: 3996063
description:
2025-11-18 04:13:21 dovecot_login authenticator failed for ([177.239.160.3]) [177.239.160.3]:41408: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.162.117
country_id: 2017370
description:
2025-11-18 04:13:32 dovecot_login authenticator failed for broadband-77-37-162-117.ip.moscow.rt.ru [77.37.162.117]:51110: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-11-18 04:13:39 dovecot_login authenticator failed for ([122.176.21.104]) [122.176.21.104]:56661: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-18 04:13:59 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br ([179.184.33.97]) [179.184.33.86]:49006: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 04:13:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<Ft6oMtlDAolSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-11-18 04:13:24 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:58548: 535 Incorrect authentication data (set_id=info@sulindustrial.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 04:13:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<nXgPNdlDjvVxoZB3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:14:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MyRdNdlDAI6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-18 04:14:06 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:44551: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.102.254.198
country_id: 2017370
description:
2025-11-18 04:13:09 dovecot_login authenticator failed for ([86.102.254.198]) [86.102.254.198]:36657: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:13:20 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:51082: 535 Incorrect authentication data (set_id=info@ufadville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-18 04:13:47 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3683: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-11-18 04:14:03 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:39039: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6eaXM9lDAICxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.229.194
country_id: 1269750
description:
Nov 18 04:14:46 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=122.187.229.194, lip=200.150.196.245, TLS, session=<goKqNtlDjKN6u+XC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:14:55 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:43926: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2025-11-18 04:14:08 dovecot_login authenticator failed for (nsg-corporate-48.223.187.122.airtel.in) [128.185.201.170]:42564: 535 Incorrect authentication data (set_id=desenvolvimento2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.16.91
country_id: 1880251
description:
2025-11-18 04:14:09 dovecot_login authenticator failed for (91.16.156.202.starhub.net.sg) [202.156.16.91]:54603: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 57.132.150.162
country_id: 6252001
description:
Nov 18 04:14:21 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@globalmedica.com.br>, method=PLAIN, rip=57.132.150.162, lip=200.150.196.245, TLS, session=<N3dXNdlD8og5hJai>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 220.130.18.21
country_id: 1668284
description:
Nov 18 04:14:41 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@globalmedica.com.br>, method=PLAIN, rip=220.130.18.21, lip=200.150.196.245, TLS, session=<UmNLNtlDhNncghIV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-18 04:14:20 dovecot_login authenticator failed for ([119.160.166.237]) [119.160.166.237]:45984: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.76.73.4
country_id: 1814991
description:
2025-11-18 04:14:28 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:52331: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.24.76.30
country_id: 6252001
description:
2025-11-18 04:14:31 dovecot_login authenticator failed for (syn-047-024-076-030.res.spectrum.com) [47.24.76.30]:52906: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0WkrN9lDgpaxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:15:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HtvBOtlDVq6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.170.146.177
country_id: 1814991
description:
2025-11-18 04:15:54 dovecot_login authenticator failed for ([111.170.146.177]) [111.170.146.177]:47864: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-18 04:16:11 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:60798: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-11-18 04:16:12 dovecot_login authenticator failed for ([49.206.201.253]) [49.206.201.253]:45902: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 04:16:49 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:62024: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:17:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1/4SQNlDwsyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.194.166
country_id: 1269750
description:
2025-11-18 04:16:31 dovecot_login authenticator failed for ([125.19.175.13]) [125.19.194.166]:49082: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VqZTPtlDLr+xV3kv>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.104
country_id: 3469034
description:
2025-11-18 04:16:44 H=(localhost) [179.0.178.104]:52565 F=<postmaster@mail.com> rejected RCPT <cursos@assembleiadedeuspiraquara.com.br>: Unrouteable address


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 71.62.34.216
country_id: 6252001
description:
Nov 18 04:16:47 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<bianca@globalmedica.com.br>, method=PLAIN, rip=71.62.34.216, lip=200.150.196.245, TLS, session=<TEgTPtlDLJJHPiLY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-11-18 04:17:01 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:45660: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 04:17:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<5AX5QdlDmEuvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 04:18:07 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:49920: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.229.194
country_id: 1269750
description:
Nov 18 04:17:11 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<bianca>, method=PLAIN, rip=122.187.229.194, lip=200.150.196.245, TLS, session=<UGxYP9lDBuF6u+XC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
country_id: 1814991
description:
2025-11-18 04:17:10 dovecot_login authenticator failed for ([101.251.197.46]) [101.251.197.46]:36074: 535 Incorrect authentication data (set_id=anderson)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 04:17:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<4mxLQdlDhJd9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:17:29 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:62011: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TVbeQdlDjNWxV3kv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 196.251.100.18
country_id: 241170
description:
[2025-11-18 04:18:19 -0300] info [cpaneld] 196.251.100.18 - fundamen "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2025-11-18 04:18:19 dovecot_login authenticator failed for ([128.185.217.27]) [128.185.218.18]:56580: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:18:32 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:36713: 535 Incorrect authentication data (set_id=info@ufadville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.232.202
country_id: 1562822
description:
2025-11-18 04:18:17 dovecot_plain authenticator failed for (w3e1qpmamxyyvjt6) [116.104.232.202]:59897: 535 Incorrect authentication data (set_id=marcos@louvoreterno.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KHVyRdlDuOyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 04:18:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<fcXSRdlDis4XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-11-18 04:18:43 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12028: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 04:18:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<PW7nRtlDVJ8naoFh>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:20:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<nz7RStlD8p6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 04:19:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<OkwxSNlDolWnYwhf>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WfQMSdlDKJexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 04:19:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<p7TzSdlD/rpn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 04:20:19 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55383: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:20:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NlqkTNlDCqixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:20:40 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:40194: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:21:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<a243UNlDLsCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.58.130.22
country_id: 1814991
description:
2025-11-18 04:22:01 dovecot_login authenticator failed for ([58.58.130.22]) [58.58.130.22]:45044: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.60
country_id: 798544
description:
2025-11-18 04:22:02 dovecot_login authenticator failed for ([31.41.84.60]) [31.41.84.60]:36818: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 04:21:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<1AmoTtlDtulns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 04:21:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<LRfDTtlDZukkMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.205.184.169
country_id: 146669
description:
2025-11-18 04:21:40 dovecot_login authenticator failed for ([185.205.184.169]) [185.205.184.169]:50298: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.106.49.149
country_id: 3932488
description:
Nov 18 04:21:56 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<paulo>, method=PLAIN, rip=200.106.49.149, lip=200.150.196.245, TLS, session=<ftONUNlDUtHIajGV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2025-11-18 04:22:07 dovecot_login authenticator failed for syn-024-105-160-100.biz.spectrum.com [24.105.160.100]:44064: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 04:21:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<zZq9TtlDRMYnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:21:25 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:43969: 535 Incorrect authentication data (set_id=info@ufadville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-11-18 04:23:03 dovecot_login authenticator failed for (189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:34690: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2025-11-18 04:22:14 dovecot_login authenticator failed for ([121.142.165.111]) [121.142.165.111]:44912: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<n+3JU9lDvNaxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:23:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<pKeMVdlDtN2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 18 04:23:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<28CjV9lDGtQkMrGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2025-11-18 04:23:44 dovecot_login authenticator failed for ([46.161.196.5]) [46.161.196.5]:57184: 535 Incorrect authentication data (set_id=jobs@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.58.144.50
country_id: 3175395
description:
2025-11-18 04:23:17 dovecot_login authenticator failed for ([101.58.144.50]) [101.58.144.50]:54977: 535 Incorrect authentication data (set_id=jobs@globalmedica.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 04:23:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@primiciapersianas.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<o93RVtlDAsikXLll>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6yRdV9lDRuuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-18 04:23:35 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:57810: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 04:23:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<SDnLWNlD2IFvAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2025-11-18 04:23:17 dovecot_login authenticator failed for ([88.215.1.201]) [88.215.1.201]:40323: 535 Incorrect authentication data (set_id=atualizacoes1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 04:23:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<2+RXVtlDEuSGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.143
country_id: 2186224
description:
2025-11-18 04:24:30 dovecot_login authenticator failed for ([121.73.163.143]) [121.73.163.143]:41628: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2025-11-18 04:24:52 dovecot_login authenticator failed for ([120.238.23.168]) [120.238.23.168]:44439: 535 Incorrect authentication data (set_id=cpanel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.202.194
country_id: 1269750
description:
2025-11-18 04:24:14 dovecot_login authenticator failed for ([152.52.19.49]) [125.23.202.194]:52814: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 04:24:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<m70aWtlDU6R3xBIC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8JLkWtlDcJGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-11-18 04:25:25 dovecot_login authenticator failed for ([128.185.247.14]) [122.184.124.46]:45020: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-11-18 04:25:32 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:60074: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:25:49 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:64776: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.87
country_id: 3625428
description:
2025-11-18 04:25:08 dovecot_login authenticator failed for ([190.114.243.80]) [190.114.243.87]:59408: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2025-11-18 04:25:10 dovecot_login authenticator failed for h-176-10-197-168.a444.priv.bahnhof.se [176.10.197.168]:53186: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 04:25:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fernandotonet.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<IU1/XdlD4o2kXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 18 04:25:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<hRzaXdlDcqaiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 04:25:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<QNcUXtlD6t6P9IUv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:25:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<CBGGXtlD0qixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.144
country_id: 1835841
description:
2025-11-18 04:25:48 dovecot_login authenticator failed for ([121.131.220.144]) [121.131.220.144]:43454: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:26:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BH5GYNlDzq+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.2.243.174
country_id: 1814991
description:
2025-11-18 04:26:02 dovecot_login authenticator failed for (mail.iemif.org) [60.2.243.174]:35884: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.141.56.185
country_id: 1814991
description:
2025-11-18 04:26:20 dovecot_login authenticator failed for ([211.141.56.185]) [211.141.56.185]:46416: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-18 04:26:42 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:35438: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 04:27:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<7aWlY9lDOKNns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:26:08 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:43869: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 04:26:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<KxacYNlD3so+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 04:26:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<qXLFYdlD2Oprhr+5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<B6MWYtlDVL+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.2.243.174
country_id: 1814991
description:
2025-11-18 04:26:51 dovecot_login authenticator failed for (mail.iemif.org) [60.2.243.174]:37100: 535 Incorrect authentication data (set_id=admin@iemif.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-18 04:27:03 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:52373: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mhCkZdlDuNCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2025-11-18 04:27:41 dovecot_login authenticator failed for ([190.67.106.221]) [190.67.106.221]:51700: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.108.14.226
country_id: 1814991
description:
2025-11-18 04:27:59 dovecot_login authenticator failed for ([202.108.14.226]) [202.108.14.226]:40194: 535 Incorrect authentication data (set_id=faturamento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-11-18 04:28:03 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:60846: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 04:27:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<WKruZNlD+pl3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 04:27:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<7CpUZdlDQsln9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.142.26
country_id: 1835841
description:
2025-11-18 04:27:43 dovecot_login authenticator failed for ([175.208.142.26]) [175.208.142.26]:49216: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.24.210.27
country_id: 1814991
description:
2025-11-18 04:27:58 dovecot_login authenticator failed for ([1.24.210.27]) [1.24.210.27]:44156: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 04:28:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<f3JRZ9lDZIcI1et7>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.28.107.251
country_id: 1880251
description:
[2025-11-18 04:28:05 -0300] info [cpaneld] 119.28.107.251 - deproi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user deproi (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 04:27:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<S6SZZNlDDMuYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.154.62.229
country_id: 1835841
description:
2025-11-18 04:27:30 dovecot_login authenticator failed for ([125.154.62.229]) [125.154.62.229]:44282: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:29:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1aEDa9lDGoSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 18 04:28:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<b887aNlDgoAIiXsk>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:28:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DDpAadlDmOSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 04:28:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<Yi1MadlDCsml0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 04:28:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<oZXFaNlDMN5A44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 93.174.95.106
country_id: 2750405
description:
Nov 18 04:28:38 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=93.174.95.106, lip=186.233.225.118, session=<oBWNadlD1p9drl9q>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 04:29:01 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52067: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 04:28:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<CfuBZ9lD+MVw2eny>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.28.107.251
country_id: 1880251
description:
[2025-11-18 04:28:06 -0300] info [cpaneld] 119.28.107.251 - deproico "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 04:28:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<MBrIaNlDBMwv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 04:29:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<9P0QbNlDCOhCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.209.102
country_id: 2017370
description:
2025-11-18 04:29:29 dovecot_login authenticator failed for 95-31-209-102.broadband.corbina.ru [95.31.209.102]:33716: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2025-11-18 04:29:30 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:54506: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 04:29:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<exfNbdlDeuNSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.130.95
country_id: 99237
description:
2025-11-18 04:29:30 dovecot_login authenticator failed for ([65.20.130.95]) [65.20.130.95]:45029: 535 Incorrect authentication data (set_id=jobs@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:29:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kmvWbNlD4IyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 04:29:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<Jr4bbdlD0IOElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.196.141
country_id: 1819730
description:
2025-11-18 04:29:50 dovecot_login authenticator failed for 42-200-196-141.static.imsbiz.com [42.200.196.141]:44726: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-11-18 04:29:52 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:33869: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2025-11-18 04:29:54 dovecot_login authenticator failed for (static.ill.117.211.15.93.bsnl.co.in) [117.211.15.93]:56996: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 18 04:30:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<brp7btlDTru317Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-18 04:29:21 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:48388: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:29:29 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:26414: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.208.169
country_id: 2661886
description:
2025-11-18 04:29:44 dovecot_login authenticator failed for 94-255-208-169.cust.bredband2.com [94.255.208.169]:39880: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.67.122.230
country_id: 1835841
description:
2025-11-18 04:30:04 dovecot_login authenticator failed for ([220.67.122.230]) [220.67.122.230]:59404: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 18 04:30:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<y8ddb9lDcpGiAOAm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 04:30:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<f8jGb9lDbt1ns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:30:30 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:57540: 535 Incorrect authentication data (set_id=info@ceramicamonallisa.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 04:30:43 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52038: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2025-11-18 04:30:47 dovecot_login authenticator failed for ([203.252.10.3]) [203.252.10.3]:14295: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.13.47.83
country_id: 1814991
description:
2025-11-18 04:30:54 dovecot_login authenticator failed for ([218.13.47.83]) [218.13.47.83]:54448: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:30:15 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:51673: 535 Incorrect authentication data (set_id=info@ufadville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2025-11-18 04:30:24 dovecot_login authenticator failed for ([154.146.240.123]) [154.146.240.123]:57916: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-11-18 04:30:28 dovecot_login authenticator failed for ([187.50.122.20]) [177.61.176.110]:33814: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2025-11-18 04:30:39 dovecot_login authenticator failed for ([119.192.59.80]) [119.192.59.80]:47780: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-18 04:30:18 dovecot_login authenticator failed for ([125.20.251.66]) [125.20.251.66]:42936: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hoVacNlD1KexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.76.73.4
country_id: 1814991
description:
2025-11-18 04:30:40 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:21372: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.152.72
country_id: 3374766
description:
2025-11-18 04:30:40 dovecot_login authenticator failed for ([102.207.152.72]) [102.207.152.72]:32839: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Kxz2c9lDKLmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:31:35 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:56736: 535 Incorrect authentication data (set_id=info@conut.org.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2025-11-18 04:31:51 dovecot_login authenticator failed for ([59.23.3.146]) [59.23.3.146]:43130: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 04:31:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<jvZXddlDEtM+PIOL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:32:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WQzBddlD8MaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 04:32:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<b0W7ddlDWqfBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.100
country_id: 3686110
description:
2025-11-18 04:31:23 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.100]:1558: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2025-11-18 04:31:25 dovecot_login authenticator failed for ([222.100.159.2]) [222.100.159.2]:53146: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-11-18 04:32:45 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:51525: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 04:32:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<0oDceNlDMr8rmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 04:32:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@primiciapersianas.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<ULYLd9lDtox2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.26.236.10
country_id: 6252001
description:
2025-11-18 04:32:32 dovecot_login authenticator failed for ([12.26.236.10]) [12.26.236.10]:52894: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:32:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ziWOd9lDkM6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.244.98.11
country_id: 1814991
description:
2025-11-18 04:32:57 dovecot_login authenticator failed for (210.241.51.119.adsl-pool.jlccptt.net.cn) [58.244.98.11]:27738: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.135.26.217
country_id: 798544
description:
2025-11-18 04:33:01 dovecot_login authenticator failed for ([31.135.26.217]) [31.135.26.217]:37034: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-11-18 04:32:44 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:62736: 535 Incorrect authentication data (set_id=exclusiverxstore@inovasiteweb.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.31.138.38
country_id: 3469034
description:
2025-11-18 04:32:50 dovecot_plain authenticator failed for 189-31-138-38.user3p.v-tal.net.br ([192.168.56.1]) [189.31.138.38]:63101: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-11-18 04:32:55 dovecot_login authenticator failed for ([152.52.199.126]) [152.52.199.126]:43170: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-11-18 04:33:00 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:42386: 535 Incorrect authentication data (set_id=exclusiverxstore)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:32:30 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:57526: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 04:32:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<IXo9d9lDcNRn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.1.74
country_id: 6252001
description:
2025-11-18 04:33:46 dovecot_login authenticator failed for (syn-070-120-001-074.res.spectrum.com) [70.120.1.74]:61819: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.186.172.37
country_id: 1814991
description:
2025-11-18 04:33:46 dovecot_login authenticator failed for ([60.186.172.37]) [60.186.172.37]:57166: 535 Incorrect authentication data (set_id=atualizacoes1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
country_id: 6252001
description:
2025-11-18 04:33:55 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:58638: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.141
country_id: 1269750
description:
2025-11-18 04:33:56 dovecot_login authenticator failed for (nsg-corporate-141.230.187.122.airtel.in) [122.187.230.141]:49176: 535 Incorrect authentication data (set_id=anderson)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 04:34:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<9ZmafNlDAOud5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 04:33:16 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:62129: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qmoge9lDquSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:33:49 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:42847: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 18 04:34:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@joelbuenoadvogados.com.br>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<MlK/fNlDktErZDwA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.100.16
country_id: 1835841
description:
2025-11-18 04:33:23 dovecot_login authenticator failed for ([59.12.100.16]) [59.12.100.16]:51229: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 04:33:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<Wm/Te9lD+sQtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 04:34:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<lDMOftlDBNRrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 04:34:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<yceXftlDaN4v+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 18 04:35:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<nwl7gNlD0JudQi/y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:34:56 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:62710: 535 Incorrect authentication data (set_id=info@ufadville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.144.34
country_id: 1269750
description:
2025-11-18 04:35:00 dovecot_login authenticator failed for ([182.78.144.34]) [182.78.144.34]:37298: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2025-11-18 04:35:01 dovecot_login authenticator failed for ([59.145.86.177]) [125.19.182.118]:59852: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.182.94
country_id: 6252001
description:
2025-11-18 04:34:10 dovecot_login authenticator failed for host94.sub-63-47-182.myvzw.com [63.47.182.94]:29774: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 04:34:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<VGQKftlDgJEO4dKR>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4MCtftlDUI2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.206
country_id: 1269750
description:
2025-11-18 04:34:46 dovecot_login authenticator failed for ([128.185.140.225]) [182.95.176.206]:34274: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 04:34:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<+mTvf9lDDuvSchJs>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:35:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DbJ7gNlDeJWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.244
country_id: 6252001
description:
2025-11-18 04:35:15 dovecot_login authenticator failed for (syn-184-152-099-244.res.spectrum.com) [184.152.99.244]:48644: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 18 04:35:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<gu/dgdlDMtlbejg7>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:35:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2uVIgtlDpJ6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
country_id: 6252001
description:
2025-11-18 04:35:43 dovecot_login authenticator failed for ool-457bdb52.dyn.optonline.net [69.123.219.82]:59071: 535 Incorrect authentication data (set_id=design)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 04:36:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<H17gg9lDFqaB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
country_id: 1814991
description:
2025-11-18 04:35:33 dovecot_login authenticator failed for ([111.61.97.108]) [111.61.97.108]:38880: 535 Incorrect authentication data (set_id=mecati)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-11-18 04:35:37 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:41220: 535 Incorrect authentication data (set_id=design@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.189.80.73
country_id: 2510769
description:
2025-11-18 04:35:45 dovecot_login authenticator failed for 73.pool92-189-80.dynamic.orange.es [92.189.80.73]:64134: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 04:35:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<NDGkg9lDqrJAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.107.193
country_id: 1814991
description:
2025-11-18 04:35:14 dovecot_login authenticator failed for ([220.180.107.193]) [220.180.107.193]:56290: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-11-18 04:35:16 dovecot_login authenticator failed for ([223.75.231.193]) [58.49.113.138]:19222: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-18 04:35:21 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:46324: 535 Incorrect authentication data (set_id=mecati@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 04:35:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<LNmpgdlDlsdCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.154.62.229
country_id: 1835841
description:
2025-11-18 04:36:45 dovecot_login authenticator failed for ([125.154.62.229]) [125.154.62.229]:57092: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SV7ThdlD/LaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 18 04:37:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<2lRlh9lDBNqnR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 04:37:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<Z/inh9lDhJ8+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.177.110
country_id: 1835841
description:
2025-11-18 04:36:13 dovecot_login authenticator failed for ([218.154.54.1]) [222.108.177.110]:40081: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2025-11-18 04:36:18 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:34286: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
country_id: 1814991
description:
2025-11-18 04:36:19 dovecot_login authenticator failed for ([218.22.0.200]) [218.22.0.200]:42674: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.201.218.146
country_id: 1814991
description:
2025-11-18 04:36:31 dovecot_login authenticator failed for ([220.201.218.146]) [220.201.218.146]:43256: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-11-18 04:36:32 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:52999: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.5
country_id: 1668284
description:
2025-11-18 04:36:49 dovecot_login authenticator failed for 111-70-32-5.emome-ip.hinet.net [111.70.32.5]:55189: 535 Incorrect authentication data (set_id=presidencia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.48.39.66
country_id: 6252001
description:
2025-11-18 04:36:16 dovecot_login authenticator failed for 99-48-39-66.lightspeed.brfrct.sbcglobal.net [99.48.39.66]:50709: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
country_id: 290557
description:
2025-11-18 04:36:35 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:38966: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.195.86.147
country_id: 690791
description:
2025-11-18 04:36:41 dovecot_plain authenticator failed for (v190l2o81hw9v08wa34mk8tykun2) [91.195.86.147]:64248: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.223.13
country_id: 2077456
description:
2025-11-18 04:36:30 dovecot_login authenticator failed for ([120.157.223.13]) [120.157.223.13]:56686: 535 Incorrect authentication data (set_id=sandromiguel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.151
country_id: 1668284
description:
2025-11-18 04:37:32 dovecot_login authenticator failed for 110-25-112-151.adsl.fetnet.net [110.25.112.151]:53566: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:37:44 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:58428: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 04:37:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<EkY9itlDNAto7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.142.62
country_id: 1269750
description:
2025-11-18 04:37:50 dovecot_login authenticator failed for (abts-mum-dynamic-062.142.179.122.airtelbroadband.in) [122.179.142.62]:36356: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:38:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<v/osi9lDzNixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:38:04 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:59915: 535 Incorrect authentication data (set_id=info@conut.org.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<u5FiidlDVM+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:38:19 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:57906: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<K/X/jNlDeumxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 04:39:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<DTKnj9lDfsvSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2025-11-18 04:39:41 dovecot_login authenticator failed for ([121.131.220.152]) [121.131.220.152]:49934: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-18 04:39:57 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:56026: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:40:05 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:60811: 535 Incorrect authentication data (set_id=info@ceramicamonallisa.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<upyNkNlDuIqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 04:39:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<JP6CkNlDuMGUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 04:39:41 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51876: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.0.3
country_id: 3469034
description:
2025-11-18 04:39:55 dovecot_login authenticator failed for (177-174-0-3.user.vivozap.com.br) [177.174.0.3]:46960: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 04:39:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@oabsjp.org.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<EGD4kdlD7JSkXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 04:41:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<M3cNltlDUoBo7MS0>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:40:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zeQqlNlDNqKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.133.35.58
country_id: 1814991
description:
2025-11-18 04:40:19 dovecot_login authenticator failed for ([117.133.35.58]) [117.133.35.58]:51374: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2025-11-18 04:40:30 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:39804: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 18 04:40:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<07TMlNlDIrYv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 04:40:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<1vosldlDEOaYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-11-18 04:40:17 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:43991: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.151
country_id: 1668284
description:
2025-11-18 04:40:21 dovecot_login authenticator failed for 110-25-112-151.adsl.fetnet.net [110.25.112.151]:56084: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:40:54 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:53895: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 04:40:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<7xNkldlDQtjBl4nP>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:41:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Li3sldlDeqqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:40:09 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:20790: 535 Incorrect authentication data (set_id=info@ufadville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.168.190
country_id: 1814991
description:
2025-11-18 04:40:09 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.168.190]:3244: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.100.16
country_id: 1835841
description:
2025-11-18 04:40:12 dovecot_login authenticator failed for ([59.12.100.16]) [59.12.100.16]:51676: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.238.15.224
country_id: 1835841
description:
2025-11-18 04:40:15 dovecot_login authenticator failed for ([218.238.15.224]) [218.238.15.224]:32938: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.250
country_id: 1835841
description:
2025-11-18 04:40:18 dovecot_login authenticator failed for ([211.247.127.250]) [211.247.127.250]:60190: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.98.177.66
country_id: 1814991
description:
2025-11-18 04:40:33 dovecot_login authenticator failed for ([112.98.177.66]) [112.98.177.66]:46961: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.25.58.19
country_id: 1643084
description:
2025-11-18 04:40:33 dovecot_login authenticator failed for ([160.25.58.19]) [160.25.58.19]:59974: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-18 04:40:07 dovecot_login authenticator failed for ([182.95.115.38]) [182.95.115.38]:33888: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 04:41:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<m+d9mNlDpsdA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.137.75.227
country_id: 3017382
description:
2025-11-18 04:41:54 dovecot_login authenticator failed for ([46.254.229.4]) [185.137.75.227]:34298: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:41:08 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:13745: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 04:41:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@alcantaraemonteiro.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<j6Yel9lD4pR2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-11-18 04:41:41 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:45550: 535 Incorrect authentication data (set_id=jobs@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-18 04:41:39 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:50544: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:41:44 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:51472: 535 Incorrect authentication data (set_id=info@conut.org.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.167
country_id: 337996
description:
2025-11-18 04:42:00 dovecot_login authenticator failed for ([196.190.43.162]) [196.190.43.167]:42930: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 04:42:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<HPKGmdlDoLQtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-11-18 04:41:22 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:48080: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5oO5l9lDCrixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 04:41:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<smTYl9lDuLukXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 04:42:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<dfrRm9lDXhOKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.18.150
country_id: 1835841
description:
2025-11-18 04:42:14 dovecot_login authenticator failed for ([112.162.18.150]) [112.162.18.150]:23696: 535 Incorrect authentication data (set_id=jobs@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-18 04:42:18 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br ([187.126.105.145]) [187.126.105.42]:46814: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 04:42:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<vl1jmtlDRo6B4rs4>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lrhDm9lD6MuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.33
country_id: 1668284
description:
2025-11-18 04:42:32 dovecot_login authenticator failed for 221-120-4-33.emome-ip.hinet.net [221.120.4.33]:57731: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.188
country_id: 3996063
description:
2025-11-18 04:42:33 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:55210: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 04:42:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<SCiqm9lDUKKl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.170
country_id: 1269750
description:
2025-11-18 04:42:55 dovecot_login authenticator failed for (nsg-corporate-48.223.187.122.airtel.in) [128.185.201.170]:45960: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 04:42:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<HACWnNlDeqed5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 04:43:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<UPMxntlDmoN3xBIC>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<o5fYntlD6tyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 04:44:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<syG7oNlDOucXXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:44:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<oLenoNlDvuuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 04:43:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<TENwndlD4uqYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 04:43:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<SmrzndlDTMSl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 04:43:23 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:51274: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 18 04:43:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=<l3s0ntlDUMyqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2025-11-18 04:43:31 dovecot_login authenticator failed for ([131.161.184.46]) [131.161.184.46]:58552: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 04:43:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<XF4Yn9lD3s6B4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 04:43:58 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51998: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.201
country_id: 3469034
description:
2025-11-18 04:44:59 dovecot_login authenticator failed for (ip-189-97-236-201.user.vivozap.com.br) [189.97.236.201]:38029: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:44:16 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:52089: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 04:44:15 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52387: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 04:44:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<+mh/odlDPsSUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 04:44:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<SiugodlDKoxns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ldp2otlDOoWxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:45:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FUQMptlDbpuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-11-18 04:45:44 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:35229: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 04:45:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<czGWpdlD/sjBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.24.40
country_id: 2017370
description:
2025-11-18 04:45:11 dovecot_login authenticator failed for (46-44-24-40.silinet.ru) [46.44.24.40]:55891: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:45:16 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:30282: 535 Incorrect authentication data (set_id=info@ufadville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.167.15
country_id: 2186224
description:
2025-11-18 04:45:25 dovecot_login authenticator failed for ([121.73.167.15]) [121.73.167.15]:32988: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 04:45:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<mdkEptlDhttAF/Qn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 04:45:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<3gqQpNlDaKaGx8nN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 04:46:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<kAjKqNlDWOKvfiX3>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Iv2UqdlDLq+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:46:39 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:44811: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.169.71.110
country_id: 1814991
description:
2025-11-18 04:46:12 dovecot_login authenticator failed for (92.84.8.221.adsl-pool.jlccptt.net.cn) [222.169.71.110]:49011: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 04:46:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<MnpzqNlDmIAkMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.91.119
country_id: 2017370
description:
2025-11-18 04:46:38 dovecot_login authenticator failed for ([178.68.91.119]) [178.68.91.119]:56581: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:47:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yYdjq9lDvLmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:46:20 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:56496: 535 Incorrect authentication data (set_id=info@conut.org.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.120.26
country_id: 1814991
description:
2025-11-18 04:46:27 dovecot_login authenticator failed for ([220.179.120.26]) [220.179.120.26]:35584: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:47:21 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:50525: 535 Incorrect authentication data (set_id=info@ceramicamonallisa.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.238
country_id: 1835841
description:
2025-11-18 04:47:23 dovecot_login authenticator failed for ([210.206.24.238]) [210.206.24.238]:15334: 535 Incorrect authentication data (set_id=anderson)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DgstrdlDdMGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 04:47:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<m9BMrdlDAoCkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.101.241.44
country_id: 1835841
description:
2025-11-18 04:47:58 dovecot_login authenticator failed for ([222.101.241.44]) [222.101.241.44]:42923: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 04:48:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fernandotonet.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<+Wm3rtlDzs92wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-11-18 04:47:14 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:45727: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 04:48:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<CY8jr9lDDtCKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.43.254.214
country_id: 732800
description:
2025-11-18 04:48:15 dovecot_login authenticator failed for cable-84-43-254-214.mnet.bg [84.43.254.214]:57973: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 04:48:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<86ayr9lDaH2nYwhf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<CzLDsNlDhNexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.80.238.162
country_id: 1814991
description:
2025-11-18 04:49:04 dovecot_login authenticator failed for ([218.80.238.162]) [218.80.238.162]:53591: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 18 04:49:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<9Q+istlD+M0zTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.21.148
country_id: 1835841
description:
2025-11-18 04:48:11 dovecot_login authenticator failed for ([221.167.21.148]) [221.167.21.148]:59250: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 04:49:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<wD+Ds9lDQuUI2Cjk>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9ztStNlDQu6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 18 04:49:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<p9LhtNlDAuB57bKF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-18 04:49:08 dovecot_login authenticator failed for ([196.191.212.236]) [213.55.85.202]:3684: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.119
country_id: 130758
description:
2025-11-18 04:49:43 dovecot_login authenticator failed for (ADMIN) [62.60.131.119]:49522: 535 Incorrect authentication data (set_id=info@advgsouza.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-18 04:49:50 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:43264: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:50:03 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:49302: 535 Incorrect authentication data (set_id=vendas@fredianipersianas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:50:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BqIYttlDIoexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 04:49:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<32CPs9lDit+ElIx5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 04:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Hj/jt9lDCJGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 04:50:41 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55965: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.61.176.53
country_id: 2017370
description:
2025-11-18 04:50:51 dovecot_login authenticator failed for (37.61.176.53.svttk.ru) [37.61.176.53]:60532: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2025-11-18 04:51:03 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:52398: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 04:51:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<RGvCudlDBIdA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 18 04:50:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<FqjDttlDWJuWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.17
country_id: 130758
description:
2025-11-18 04:50:19 dovecot_login authenticator failed for (ADMIN) [62.60.131.17]:64151: 535 Incorrect authentication data (set_id=info@conut.org.br)


