# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 07:12:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<0WEfs9tDEqkv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 07:14:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<9QLduNtDhO0rmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.254.26
country_id: 1269750
description:
2025-11-18 07:13:27 dovecot_login authenticator failed for ([125.21.188.41]) [125.19.254.26]:50108: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FJFTt9tDZoSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 07:13:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<g3Rlt9tD78p3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2025-11-18 07:13:58 dovecot_login authenticator failed for ([121.73.169.149]) [121.73.169.149]:37396: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.17.96
country_id: 2077456
description:
2025-11-18 07:13:45 dovecot_login authenticator failed for ([120.157.17.96]) [120.157.17.96]:43436: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.94
country_id: 6252001
description:
2025-11-18 07:14:01 dovecot_login authenticator failed for ([139.60.85.94]) [139.60.85.94]:43357: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:14:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Q9AeudtD1pGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 07:13:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<Xl7ytdtD7J+P9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.192
country_id: 6252001
description:
2025-11-18 07:13:25 dovecot_login authenticator failed for ([208.69.161.192]) [208.69.161.192]:52167: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.119
country_id: 1814991
description:
2025-11-18 07:13:40 dovecot_login authenticator failed for ([27.24.141.119]) [27.24.141.119]:42646: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 07:13:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<j+zpt9tDGNVAF/Qn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 18 07:14:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<BHzquttDlL1bejg7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 07:14:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<SH9Nu9tD3JFCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.148.100.210
country_id: 2017370
description:
2025-11-18 07:14:42 dovecot_login authenticator failed for ([46.148.100.210]) [46.148.100.210]:55712: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.158.118.171
country_id: 2017370
description:
2025-11-18 07:14:52 dovecot_login authenticator failed for ([5.158.118.171]) [5.158.118.171]:54788: 535 Incorrect authentication data (set_id=secretarioadjunto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 07:14:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@brinquelocacoes.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<vm00udtDeKYrmxBp>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+rPfuttD7J6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.159.174.17
country_id: 1835841
description:
2025-11-18 07:14:29 dovecot_login authenticator failed for ([221.159.174.17]) [221.159.174.17]:35466: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 07:14:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<VuLputtDLq+d5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.199.32.174
country_id: 3469034
description:
2025-11-18 07:14:38 dovecot_login authenticator failed for (18776239145.telemar.net.br) [200.199.32.174]:60498: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.6.16.137
country_id: 1835841
description:
2025-11-18 07:14:57 dovecot_login authenticator failed for ([14.6.16.137]) [14.6.16.137]:35759: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 18 07:14:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<KF/PudtDxO2iAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-18 07:14:23 dovecot_login authenticator failed for ([152.231.25.65]) [152.231.25.64]:48922: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BEd0vttDhrmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 07:15:38 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52228: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 07:15:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<1fTuvttD+tAtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 07:15:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<a0iOv9tDAt1rhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.135.168.148
country_id: 1814991
description:
2025-11-18 07:16:49 dovecot_login authenticator failed for ([219.135.168.148]) [219.135.168.148]:39793: 535 Incorrect authentication data (set_id=leandro@eloempresas.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.177.110
country_id: 1835841
description:
2025-11-18 07:16:49 dovecot_login authenticator failed for ([222.108.177.110]) [222.108.177.110]:33505: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.3
country_id: 1668284
description:
2025-11-18 07:16:51 dovecot_login authenticator failed for 111-70-32-3.emome-ip.hinet.net [111.70.32.3]:58880: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-11-18 07:17:03 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:57046: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.95.221
country_id: 2017370
description:
2025-11-18 07:16:33 dovecot_login authenticator failed for broadband-178-140-95-221.ip.moscow.rt.ru [178.140.95.221]:44836: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-11-18 07:16:45 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:32877: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-11-18 07:16:48 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:53475: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:17:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<77/Zw9tDROCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-11-18 07:17:06 dovecot_login authenticator failed for ([173.25.186.130]) [173.25.186.130]:55921: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 07:16:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<QtrwwNtDqcB3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 07:16:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<3idFwdtDruEI1et7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-18 07:16:36 dovecot_login authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:60715: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-11-18 07:17:01 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:3072: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-18 07:17:04 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:56612: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6oEIwttD6s2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 07:16:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<VuBOw9tDqsql0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.76.5.36
country_id: 2017370
description:
2025-11-18 07:17:21 dovecot_login authenticator failed for (pppoe-87-76-5.36.evolife.su) [87.76.5.36]:59180: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 07:17:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<Lv1TxdtDuKeYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.12.240.14
country_id: 2017370
description:
2025-11-18 07:18:01 dovecot_login authenticator failed for ([85.12.240.14]) [85.12.240.14]:38130: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2025-11-18 07:18:05 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:47395: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.41.217
country_id: 2077456
description:
2025-11-18 07:17:13 dovecot_login authenticator failed for 110-175-41-217.static.tpgi.com.au [110.175.41.217]:59126: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.112
country_id: 1814991
description:
2025-11-18 07:17:13 dovecot_login authenticator failed for ([27.24.141.112]) [27.24.141.112]:53942: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.220.231
country_id: 99237
description:
2025-11-18 07:17:16 dovecot_login authenticator failed for ([93.191.115.52]) [194.31.220.231]:51496: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lniWxdtDKOuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.87.177.252
country_id: 6252001
description:
2025-11-18 07:17:08 dovecot_login authenticator failed for (mail.jimsmithcenters.com) [38.87.177.252]:56066: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KqopydtDlpqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 07:18:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<qcvIydtDho2KxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 18 07:18:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<1XFnyttDkryiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.137.31.134
country_id: 1814991
description:
2025-11-18 07:18:54 dovecot_login authenticator failed for ([113.137.31.134]) [113.137.31.134]:56110: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-11-18 07:18:14 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:46283: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.152.72
country_id: 3374766
description:
2025-11-18 07:18:26 dovecot_login authenticator failed for ([102.207.152.72]) [102.207.152.72]:51886: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 07:19:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<iV+LzdtDxI8O4dKR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-11-18 07:19:55 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:48504: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:20:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<J16HzttDEL+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 07:20:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<Pm6LzttDiMZw2eny>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.20.228.20
country_id: 1269750
description:
2025-11-18 07:19:27 dovecot_login authenticator failed for ([157.20.228.20]) [157.20.228.20]:33654: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 07:19:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<sF8ozdtDGJKYNbyQ>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<aZfEzNtDbrOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
country_id: 1835841
description:
2025-11-18 07:19:54 dovecot_login authenticator failed for ([111.171.125.94]) [111.171.125.94]:51377: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
country_id: 3469034
description:
2025-11-18 07:20:25 dovecot_login authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:51819: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-11-18 07:20:31 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:52030: 535 Incorrect authentication data (set_id=contato@cantoramaralima.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<d0xV0NtDcMqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 07:20:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@oabsjp.org.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<0f2S0NtDEJZ2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.16
country_id: 3996063
description:
2025-11-18 07:20:58 dovecot_login authenticator failed for (201.173.216.16-clientes-izzi.mx) [201.173.216.16]:39038: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-11-18 07:21:03 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:49559: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-18 07:21:16 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:38936: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.220.255.230
country_id: 2017370
description:
2025-11-18 07:21:44 dovecot_login authenticator failed for ([83.220.255.230]) [83.220.255.230]:50539: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 07:21:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<resy1dtDFAunYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 07:21:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<yrH409tDAMtSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.95.9
country_id: 1814991
description:
2025-11-18 07:21:40 dovecot_login authenticator failed for ([218.23.95.9]) [218.23.95.9]:40058: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Nov 18 07:21:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=<GZOZ1NtDpODBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 07:21:59 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:63265: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.227.180
country_id: 921929
description:
2025-11-18 07:21:20 dovecot_login authenticator failed for ([197.255.227.180]) [197.255.227.180]:8200: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.92.235.70
country_id: 1210997
description:
2025-11-18 07:21:27 dovecot_login authenticator failed for ([180.92.235.70]) [180.92.235.70]:57780: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cB7l09tD5uOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.33.154
country_id: 1562822
description:
2025-11-18 07:22:20 dovecot_login authenticator failed for (nhavuivn.com) [210.245.33.154]:57866: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 07:22:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<m+Hq1ttDjNSUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.12.240.14
country_id: 2017370
description:
2025-11-18 07:22:29 dovecot_login authenticator failed for ([85.12.240.14]) [85.12.240.14]:50904: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 07:22:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<h+de2NtDBshAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.78.131
country_id: 2077456
description:
2025-11-18 07:22:57 dovecot_login authenticator failed for ([123.209.78.131]) [123.209.78.131]:41812: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:23:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4mFF2dtDHJqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 07:23:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<PwNy2dtDdIOkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 07:22:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<1u9Y1ttD5IWElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 07:22:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<ak2M1ttD0JrSchJs>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ouiD19tDrJCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 07:23:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<tB/E2ttDqpiB4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 07:23:34 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:57001: 535 Incorrect authentication data (set_id=admin@cleservicosindustriais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-11-18 07:23:40 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:59214: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.122
country_id: 1668284
description:
2025-11-18 07:23:53 dovecot_login authenticator failed for 111-70-3-122.emome-ip.hinet.net [111.70.3.122]:42434: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.89.87
country_id: 690791
description:
2025-11-18 07:24:00 dovecot_login authenticator failed for (host87-89-16-178.reedlan.com) [178.16.89.87]:53930: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PYIU29tDwKexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.241.128.197
country_id: 6252001
description:
2025-11-18 07:23:32 dovecot_login authenticator failed for (syn-067-241-128-197.res.spectrum.com) [67.241.128.197]:60314: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 07:23:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<EbcS3NtDMPyKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-11-18 07:23:54 dovecot_login authenticator failed for ([122.184.143.81]) [182.95.47.2]:42736: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.56.170
country_id: 732800
description:
2025-11-18 07:24:08 dovecot_login authenticator failed for 46-10-56-170.ip.btc-net.bg [46.10.56.170]:53550: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.224.226.192
country_id: 6251999
description:
2025-11-18 07:24:12 dovecot_login authenticator failed for host-24-224-226-192.public.eastlink.ca [24.224.226.192]:55454: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 07:24:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@f5assessoria.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<fdS33dtD6JOkXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2025-11-18 07:24:26 dovecot_login authenticator failed for ([128.185.254.54]) [128.185.254.54]:33436: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4CCs3ttDNr+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 07:24:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<WHjJ3ttDJqAtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 07:24:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<9xEN3dtDtoA+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.171.27.248
country_id: 1814991
description:
2025-11-18 07:25:02 dovecot_login authenticator failed for ([116.171.27.248]) [116.171.27.248]:58208: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:26:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2pwI5NtD4uOxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VvM24ttDitqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.52
country_id: 2017370
description:
2025-11-18 07:25:40 dovecot_login authenticator failed for ([178.178.222.52]) [178.178.222.52]:57544: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 07:25:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=</RO24ttDBoNns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 07:25:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<c2zf4ttD2NYI2Cjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 18 07:26:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<wlHz49tDEs4zTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 18 07:25:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<atnb4NtDboIIiXsk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 07:25:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<zvIb4ttDJs8tPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.76.5.36
country_id: 2017370
description:
2025-11-18 07:26:34 dovecot_login authenticator failed for (pppoe-87-76-5.36.evolife.su) [87.76.5.36]:60812: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.161.44.92
country_id: 1562822
description:
2025-11-18 07:26:50 dovecot_login authenticator failed for ([14.161.44.92]) [14.161.44.92]:48233: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.127.128
country_id: 3144096
description:
2025-11-18 07:27:03 dovecot_login authenticator failed for (cm-46.212.127.128.get.no) [46.212.127.128]:47372: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.237.47.241
country_id: 1835841
description:
2025-11-18 07:26:09 dovecot_login authenticator failed for ([175.237.47.241]) [175.237.47.241]:57286: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zxPK5dtDVoixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 07:26:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<Qq6u5dtDdOnSchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 07:26:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<PJHD5dtDzJCl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-18 07:27:05 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:58508: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.7.248.50
country_id: 1814991
description:
2025-11-18 07:26:24 dovecot_login authenticator failed for ([116.7.248.50]) [116.7.248.50]:52122: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 07:26:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<UGd45ttDer9A44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 07:26:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<Go4/59tDzImUcQQF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<GddZ6dtD/KGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-18 07:27:33 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:37806: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2025-11-18 07:27:35 dovecot_login authenticator failed for ([207.219.221.53]) [207.219.221.53]:56329: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 07:27:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@primiciapersianas.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<gOU26NtD4qukXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.173.225.128
country_id: 1814991
description:
2025-11-18 07:27:29 dovecot_login authenticator failed for ([219.140.170.34]) [59.173.225.128]:2035: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.159.82
country_id: 1269750
description:
2025-11-18 07:27:51 dovecot_login authenticator failed for ([182.76.108.121]) [182.78.159.82]:38592: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.99.40
country_id: 149590
description:
2025-11-18 07:27:09 dovecot_login authenticator failed for ([41.59.99.40]) [41.59.99.40]:59573: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.188.123.61
country_id: 2017370
description:
2025-11-18 07:27:48 dovecot_login authenticator failed for (89-188-123-61.dyn-pool.spb.citytelecom.ru) [89.188.123.61]:51804: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-18 07:28:52 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:45893: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 07:29:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fernandotonet.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<vrp47ttDxIykXLll>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:29:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<k6K37ttDaMyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 07:28:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<JmPT69tDSOKB4kCN>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:28:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7An87NtDxsCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 07:28:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<sV1Y7dtDNoekXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.64.86
country_id: 1269750
description:
2025-11-18 07:29:20 dovecot_login authenticator failed for (nsg-corporate-80.50.185.122.airtel.in) [122.186.64.86]:42878: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uNiM8NtDotuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 07:29:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<lTR48NtD9MKGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.114.36
country_id: 1814991
description:
2025-11-18 07:29:36 dovecot_login authenticator failed for ([58.16.114.36]) [58.16.114.36]:52448: 535 Incorrect authentication data (set_id=loopert@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-11-18 07:30:03 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:40557: 535 Incorrect authentication data (set_id=loopert)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 18 07:30:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<kHtP8ttD+MB57bKF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 07:30:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<Dj2i89tDdKp3xBIC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XXgc9NtDYImxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.22.27.146
country_id: 2300660
description:
2025-11-18 07:30:33 dovecot_login authenticator failed for ([102.22.27.146]) [102.22.27.146]:50080: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-11-18 07:30:44 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:34171: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 07:30:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<9g3B9NtD3DGnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-11-18 07:30:53 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:59752: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.243.109.221
country_id: 2750405
description:
2025-11-18 07:30:20 dovecot_plain authenticator failed for ([151.243.109.221]) [151.243.109.221]:57548: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2025-11-18 07:31:18 dovecot_login authenticator failed for ([119.192.59.80]) [119.192.59.80]:42059: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-18 07:31:24 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:53160: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 18 07:31:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<y0A7+NtD4LudQi/y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-18 07:32:06 dovecot_login authenticator failed for ([182.95.176.130]) [182.95.176.130]:38478: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:31:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kSy199tDJKOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 18 07:31:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<ZsiT99tD3D+317Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 07:31:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<lMef99tDIIyl0iHB>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:32:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tXl5+dtDdrexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 18 07:32:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@acqualuzcuritiba.com>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<3m0R+ttDHt2nR+bm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HQZI+9tDKsmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.196.134
country_id: 1814991
description:
2025-11-18 07:32:37 dovecot_login authenticator failed for ([220.189.196.134]) [220.189.196.134]:53765: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2025-11-18 07:32:38 dovecot_login authenticator failed for ([195.222.59.157]) [195.222.59.157]:44344: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 07:32:41 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51605: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.39.27.8
country_id: 1835841
description:
2025-11-18 07:32:47 dovecot_login authenticator failed for (devserver.gaonsoft.com) [118.39.27.8]:47398: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 07:32:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<ak/j+dtDctdSczCz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HOzS/ttDXOqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2025-11-18 07:33:45 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:47778: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.57.17.172
country_id: 1814991
description:
2025-11-18 07:33:22 dovecot_login authenticator failed for ([111.57.17.172]) [111.57.17.172]:47796: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-11-18 07:33:28 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:56143: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 07:34:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<y02lAdxDFLEv7PP+>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<n29jAtxDgJexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.58
country_id: 1269750
description:
2025-11-18 07:34:36 dovecot_login authenticator failed for ([152.52.234.148]) [125.19.216.58]:38970: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 07:34:47 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50151: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2025-11-18 07:34:47 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:60967: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:35:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fQQuBNxDDqexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 07:35:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<1yk0BdxDBt+B4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.232.167
country_id: 2017370
description:
2025-11-18 07:36:04 dovecot_login authenticator failed for ([95.221.232.167]) [95.221.232.167]:52674: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 07:36:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<jlP4B9xD8tFA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2025-11-18 07:35:10 dovecot_login authenticator failed for (static.91.254.104.190.cps.com.ar) [190.104.254.91]:47476: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZEsABtxDqrSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 07:35:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<nK02B9xD4B+vfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.65.138
country_id: 1269750
description:
2025-11-18 07:35:56 dovecot_login authenticator failed for ([27.124.65.138]) [27.124.65.138]:47683: 535 Incorrect authentication data (set_id=recepcao)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.51.205.170
country_id: 6252001
description:
2025-11-18 07:35:31 dovecot_login authenticator failed for pool-108-51-205-170.washdc.fios.verizon.net [108.51.205.170]:58046: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.239.160.3
country_id: 3996063
description:
2025-11-18 07:36:16 dovecot_login authenticator failed for ([177.239.160.3]) [177.239.160.3]:57398: 535 Incorrect authentication data (set_id=nfe)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 18 07:36:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<NBTACdxDeKaWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 07:37:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<vP1qC9xD3rsrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.120
country_id: 1814991
description:
2025-11-18 07:36:49 dovecot_login authenticator failed for ([111.26.95.120]) [111.26.95.120]:33052: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 07:36:12 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:59535: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-18 07:36:22 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:65358: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bRONCdxD9tWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 07:36:33 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:54697: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
country_id: 1835841
description:
2025-11-18 07:37:08 dovecot_login authenticator failed for ([211.253.10.61]) [211.253.10.61]:52863: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.248.31
country_id: 1835841
description:
2025-11-18 07:37:08 dovecot_login authenticator failed for ([121.188.248.31]) [121.188.248.31]:59108: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.12.132.157
country_id: 1269750
description:
2025-11-18 07:37:54 dovecot_login authenticator failed for (rev.perfectinternet.in) [103.12.132.157]:39290: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.100.48
country_id: 241170
description:
Nov 18 07:37:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<financeiro@inovasite.com>, method=PLAIN, rip=196.251.100.48, lip=200.150.196.245, session=</FZeDtxD4qHE+2Qw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-11-18 07:37:11 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:39889: 535 Incorrect authentication data (set_id=adezir@transoltransportes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 07:37:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<Tg8mDNxD+p0XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-11-18 07:37:24 dovecot_login authenticator failed for (189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:51862: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2025-11-18 07:37:28 dovecot_login authenticator failed for ([95.79.108.51]) [95.79.108.51]:43525: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.17.163.44
country_id: 6252001
description:
2025-11-18 07:38:04 dovecot_login authenticator failed for (173-17-163-44.client.mchsi.com) [173.17.163.44]:40926: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<aHIdDdxDkImxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.97.109.192
country_id: 1835841
description:
2025-11-18 07:37:38 dovecot_login authenticator failed for ([210.97.109.192]) [210.97.109.192]:43685: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:38:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YWntDtxDnJaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 07:37:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<QAsHDdxDYL99gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-18 07:37:38 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:44486: 535 Incorrect authentication data (set_id=adezir)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.229.126
country_id: 1269750
description:
2025-11-18 07:38:25 dovecot_login authenticator failed for ([125.21.7.97]) [128.185.229.126]:48552: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<c0O2ENxD9KWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.135.6.10
country_id: 1814991
description:
2025-11-18 07:38:43 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:50863: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.195.126.170
country_id: 2017370
description:
2025-11-18 07:38:49 dovecot_login authenticator failed for ([176.195.126.170]) [176.195.126.170]:53761: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 07:38:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<JivlEdxDqJo7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2025-11-18 07:38:07 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:55850: 535 Incorrect authentication data (set_id=info@lorussoimoveis.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 177.4.64.247
country_id: 3469034
description:
[2025-11-18 07:38:23 -0300] info [webmaild] 177.4.64.247 - contato@magicoxavier.com.br "GET /cpsess4681237124/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 07:39:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<C8DgEtxDkNxCYSpH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qMZQFNxDUMCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 07:39:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<BBUYFdxD4sGElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-11-18 07:40:02 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:63445: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:41:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QIKkGdxDboCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-18 07:40:22 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:35416: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 07:40:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<6XxnF9xD6KeB4rs4>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0tXhF9xDPOCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 07:40:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<rbTMF9xD/tZ3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.205
country_id: 2750405
description:
2025-11-18 07:40:33 dovecot_login authenticator failed for (ADMIN) [84.54.33.205]:52824: 535 Incorrect authentication data (set_id=novoamparo@adlondrina.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 07:40:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<9gv8F9xDgOZn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.72.64.32
country_id: 6252001
description:
Nov 18 07:41:57 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<junior.gomes@sindeesfort.com.br>, method=LOGIN, rip=148.72.64.32, lip=200.150.196.245, session=<R8a1HNxDTriUSEAg>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 07:41:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<Pv2eGtxDyt6YNbyQ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<nktsG9xDBJKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-11-18 07:41:33 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:53397: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 07:41:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<zX2yG9xDipxns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2025-11-18 07:41:49 dovecot_login authenticator failed for ([61.1.105.105]) [61.1.105.105]:53990: 535 Incorrect authentication data (set_id=recepcao)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 07:41:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<tdCSHNxDfLqd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 07:42:15 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:53004: 535 Incorrect authentication data (set_id=admin@jacgeneralcleaning.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SSILH9xDvKaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.252.21.240
country_id: 1562822
description:
2025-11-18 07:42:34 dovecot_login authenticator failed for (static.vnpt-hanoi.com.vn) [222.252.21.240]:35909: 535 Incorrect authentication data (set_id=support@fottolegal.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.155.199.176
country_id: 3469034
description:
Nov 18 07:42:53 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, session=<yDw+INxDJP+xm8ew>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 07:42:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<X5tSHtxDtqYkMrBu>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 177.4.64.247
country_id: 3469034
description:
[2025-11-18 07:42:40 -0300] info [webmaild] 177.4.64.247 - xavier@projetocircense.com.br "GET /cpsess9988883684/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 07:42:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@oabsjp.org.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<CpGwH9xD3LekXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.166.134.9
country_id: 1814991
description:
2025-11-18 07:42:55 dovecot_login authenticator failed for (9.134.166.220.broad.dy.sc.dynamic.163data.com.cn) [220.166.134.9]:43966: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.164.159.86
country_id: 1814991
description:
2025-11-18 07:42:31 dovecot_login authenticator failed for ([119.164.159.86]) [119.164.159.86]:57698: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 07:42:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<PKTfHtxDGrmUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2025-11-18 07:42:46 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:40233: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.155.199.176
country_id: 3469034
description:
Nov 18 07:42:52 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=<shw8INxDG/+xm8ew>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 07:42:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<hLbPH9xDcJl9gnHM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 07:42:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<N9/dH9xDgsxxoZB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 07:43:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<VBNkI9xDoqnBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.86.13
country_id: 3996063
description:
2025-11-18 07:43:53 dovecot_login authenticator failed for (201.173.86.13-clientes-izzi.mx) [201.173.86.13]:41497: 535 Incorrect authentication data (set_id=administrativo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 07:43:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<0yY5ItxDkrRSczCz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IBKYItxDcsKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2025-11-18 07:43:39 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:45743: 535 Incorrect authentication data (set_id=administrativo@cleservicosindustriais.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 07:43:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<egoEI9xDALSP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 18 07:44:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<bdBJJ9xD3qMvT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.220.47.242
country_id: 2017370
description:
2025-11-18 07:44:18 dovecot_login authenticator failed for ([95.220.47.242]) [95.220.47.242]:51260: 535 Incorrect authentication data (set_id=juliana@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2025-11-18 07:44:26 dovecot_login authenticator failed for ([180.71.9.31]) [180.71.9.31]:38700: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DdQpJtxDtOCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
country_id: 1880251
description:
2025-11-18 07:44:40 dovecot_login authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:43572: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 07:44:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<RJicJtxD7sEtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
country_id: 1835841
description:
2025-11-18 07:44:49 dovecot_login authenticator failed for ([1.235.192.130]) [1.235.192.130]:58972: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-18 07:44:29 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:43170: 535 Incorrect authentication data (set_id=juliana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 07:44:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<QAsaJ9xDvJcv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
country_id: 1814991
description:
2025-11-18 07:45:50 dovecot_login authenticator failed for ([1.82.135.154]) [1.82.135.154]:32795: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:46:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OwyKK9xDjp+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 07:45:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<A9XnKNxDUNhvAEul>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 07:45:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<3+dKKdxDYOxxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.76.5.36
country_id: 2017370
description:
2025-11-18 07:45:30 dovecot_login authenticator failed for (pppoe-87-76-5.36.evolife.su) [87.76.5.36]:35868: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YELFKdxD+JOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 07:45:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@primiciapersianas.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<eqaxKdxDxuh2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.106.102
country_id: 6252001
description:
2025-11-18 07:45:49 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:55664: 535 Incorrect authentication data (set_id=bruno)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.211.102
country_id: 2017370
description:
2025-11-18 07:45:10 dovecot_login authenticator failed for ([109.233.211.102]) [109.233.211.102]:51526: 535 Incorrect authentication data (set_id=misterthomas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
country_id: 2017370
description:
2025-11-18 07:45:11 dovecot_login authenticator failed for (dialup-solikamsk-212.120.163.110.uralcom.com) [212.120.163.110]:51391: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.1.61
country_id: 6252001
description:
2025-11-18 07:45:27 dovecot_login authenticator failed for ([24.121.1.61]) [24.121.1.61]:39914: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.6
country_id: 1819730
description:
2025-11-18 07:47:06 dovecot_login authenticator failed for (m121-202-152-6.smartone.com) [121.202.152.6]:15110: 535 Incorrect authentication data (set_id=novamanha)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KR1SLdxDfKuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
country_id: 1814991
description:
2025-11-18 07:46:39 dovecot_login authenticator failed for ([61.145.163.164]) [61.145.163.164]:49297: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.169
country_id: 6252001
description:
2025-11-18 07:46:45 dovecot_login authenticator failed for (mobile-166-195-195-169.mycingular.net) [166.195.195.169]:47697: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2025-11-18 07:46:50 dovecot_login authenticator failed for (oabsjp.org.br) [61.50.119.110]:12462: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.92.66.188
country_id: 6251999
description:
2025-11-18 07:46:54 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:52571: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.80.100.235
country_id: 6252001
description:
2025-11-18 07:46:10 dovecot_login authenticator failed for 216-80-100-235.il.subnet.cable.rcncustomer.com [216.80.100.235]:41339: 535 Incorrect authentication data (set_id=atualizacoes1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.102
country_id: 6252001
description:
2025-11-18 07:46:35 dovecot_login authenticator failed for ([70.174.168.102]) [70.174.168.102]:55298: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.224.10
country_id: 1269750
description:
2025-11-18 07:46:36 dovecot_login authenticator failed for ([125.20.224.10]) [125.20.224.10]:53646: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 07:46:45 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52075: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
country_id: 1210997
description:
2025-11-18 07:47:00 dovecot_login authenticator failed for ([202.84.34.85]) [202.84.34.85]:58326: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-11-18 07:46:39 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:37916: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-11-18 07:46:45 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:45630: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.94.220.9
country_id: 1814991
description:
2025-11-18 07:46:51 dovecot_login authenticator failed for ([183.94.220.9]) [183.94.220.9]:44072: 535 Incorrect authentication data (set_id=novamanha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-18 07:46:33 dovecot_login authenticator failed for (lorussoimoveis.com.br) [112.122.54.54]:12258: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-11-18 07:47:06 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:55166: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.180.129
country_id: 1835841
description:
2025-11-18 07:47:49 dovecot_login authenticator failed for ([175.198.180.129]) [175.198.180.129]:36424: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 07:47:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<x9riMdxD3Nxrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2025-11-18 07:47:15 dovecot_login authenticator failed for (oabsjp.org.br) [61.50.119.110]:16776: 535 Incorrect authentication data (set_id=test@oabsjp.org.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 07:47:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<El0TMNxD7r1ns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-11-18 07:47:42 dovecot_login authenticator failed for (90.pool90-173-78.static.orange.es) [90.173.78.90]:40899: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bAzmMNxDRsixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
country_id: 99237
description:
2025-11-18 07:47:33 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:57077: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.89.48.175
country_id: 1814991
description:
2025-11-18 07:47:58 dovecot_login authenticator failed for (175.48.89.218.broad.ls.sc.dynamic.163data.com.cn) [218.89.48.175]:51422: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.79.243
country_id: 1527747
description:
2025-11-18 07:48:03 dovecot_login authenticator failed for ([77.95.56.101]) [92.62.79.243]:51691: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-11-18 07:47:12 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:36673: 535 Incorrect authentication data (set_id=info@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.25.186.130
country_id: 6252001
description:
2025-11-18 07:47:27 dovecot_login authenticator failed for ([173.25.186.130]) [173.25.186.130]:59916: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.141
country_id: 1269750
description:
2025-11-18 07:47:30 dovecot_login authenticator failed for ([122.187.230.141]) [122.187.230.141]:53596: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-11-18 07:49:04 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:45502: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 07:49:06 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:63591: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 07:48:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<7moWNNxDfN6Gx8nN>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Cnp9NNxDWOexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 07:48:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<NMUiNdxD4uJCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.140.211
country_id: 1814991
description:
2025-11-18 07:48:54 dovecot_login authenticator failed for ([112.25.140.211]) [112.25.140.211]:44449: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.205.188.194
country_id: 1835841
description:
2025-11-18 07:48:07 dovecot_login authenticator failed for ([119.205.188.194]) [119.205.188.194]:59552: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.187.13
country_id: 3469034
description:
2025-11-18 07:48:59 dovecot_login authenticator failed for ([191.59.187.13]) [191.59.187.13]:49438: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.79.241.214
country_id: 2017370
description:
2025-11-18 07:49:02 dovecot_login authenticator failed for ([37.79.241.214]) [37.79.241.214]:49542: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 07:48:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<y7zgMtxD8tNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 07:48:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<xndrM9xDPM5SnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-11-18 07:48:50 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:56340: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:49:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9mQ+NtxDXoOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-11-18 07:48:48 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:39505: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-11-18 07:49:23 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:58864: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-18 07:49:41 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:37702: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-11-18 07:49:52 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:41674: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.213.83.10
country_id: 1643084
description:
[2025-11-18 07:49:56 -0300] info [cpaneld] 185.213.83.10 - hoteljoi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.73.94
country_id: 1269750
description:
2025-11-18 07:49:16 dovecot_login authenticator failed for ([125.19.196.193]) [182.78.73.94]:46510: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.240.210
country_id: 1269750
description:
2025-11-18 07:49:21 dovecot_login authenticator failed for (nsg-corporate-210.240.187.122.airtel.in) [122.187.240.210]:32890: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hCcPONxDOJWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.38.78
country_id: 1835841
description:
2025-11-18 07:49:57 dovecot_login authenticator failed for ([112.168.38.78]) [112.168.38.78]:39682: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 07:49:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<k9TpNtxD5pEnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-18 07:49:20 dovecot_login authenticator failed for ([90.161.217.228]) [90.161.217.228]:60240: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 07:51:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<lLt7PdxDVKov+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.101.217.177
country_id: 289688
description:
2025-11-18 07:51:06 dovecot_login authenticator failed for ([78.101.217.177]) [78.101.217.177]:56626: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-18 07:50:58 H=(195.3.134.135) [179.0.178.53]:64100 F=<erictremblaysi@hotmail.com> rejected RCPT <fabricadehomepage@transol.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:64100 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 07:50:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<0UJqOtxDJr6d5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 07:50:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<OWJvO9xDQlivfiX3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</ZGbO9xDGq6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 07:50:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<IQCFO9xDbOxvAEul>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 07:50:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<xSrKO9xDeIdns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-11-18 07:50:39 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:58748: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 07:50:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<NEQUPNxDuI9AF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 07:51:03 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52349: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1kQvP9xDZsqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-18 07:51:48 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:38558: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.14.2
country_id: 1668284
description:
2025-11-18 07:51:58 dovecot_login authenticator failed for (58-115-14-2.twt1.com.tw) [58.115.14.2]:39096: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:52:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<v5QFQdxDJNixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 07:51:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<DPOpPtxDlKMnaoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 18 07:51:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<sO34PtxD+l8kMrGr>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<sn/GQtxDAO2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.175.201.167
country_id: 3469034
description:
2025-11-18 07:52:43 dovecot_login authenticator failed for 200.175.201.167.dynamic.dialup.gvt.net.br (corporate.static.gvt.net.br) [200.175.201.167]:55348: 535 Incorrect authentication data (set_id=programador@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
country_id: 2017370
description:
2025-11-18 07:52:57 dovecot_login authenticator failed for (dialup-solikamsk-212.120.163.110.uralcom.com) [212.120.163.110]:46342: 535 Incorrect authentication data (set_id=novalondrina)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2025-11-18 07:53:01 dovecot_login authenticator failed for ([121.131.220.152]) [121.131.220.152]:60226: 535 Incorrect authentication data (set_id=programador)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 07:53:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<2AReRNxD9qVn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.112
country_id: 1814991
description:
2025-11-18 07:52:19 dovecot_login authenticator failed for ([27.24.141.112]) [27.24.141.112]:36106: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 07:52:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<VpTgQdxD+MzBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 07:52:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<hAtLQtxDSNN3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 07:52:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<2XhSQdxDnJktPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 07:52:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<IpobQ9xDyuil0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 07:52:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<zDTmQtxDkKMrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 07:52:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pousadarincaoalegre.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=</Om3QdxD7NlzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.17.38
country_id: 3469034
description:
2025-11-18 07:52:19 dovecot_login authenticator failed for ([186.239.246.145]) [187.8.17.38]:52720: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2025-11-18 07:52:31 dovecot_login authenticator failed for ([111.26.63.86]) [111.26.63.87]:50312: 535 Incorrect authentication data (set_id=novalondrina@cieadep.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-11-18 07:52:48 dovecot_login authenticator failed for ([122.184.143.81]) [182.95.47.2]:44072: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 07:52:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<JIOeQ9xDrk1o7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
country_id: 1814991
description:
2025-11-18 07:52:13 dovecot_login authenticator failed for ([61.145.163.164]) [61.145.163.164]:56055: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 07:54:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<YSjgR9xDCtpw2eny>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:53:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VFdjRtxDbqaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 07:53:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<xP36RtxDfoSP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 18 07:53:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<gG48R9xDuodbejg7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.140.212.144
country_id: 2017370
description:
2025-11-18 07:53:59 dovecot_login authenticator failed for ([5.140.212.144]) [5.140.212.144]:35291: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 07:54:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<Ggv9R9xDwKKYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-11-18 07:54:01 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:58990: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 07:54:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<q9VnS9xDWrlCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.135.46.118
country_id: 1269750
description:
2025-11-18 07:55:01 dovecot_login authenticator failed for (static.bb.ill.59.92.236.111.bsnl.in) [103.135.46.118]:34372: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:55:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SUW4S9xDpN+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 07:54:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<Pc3+SdxDWt1A44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.138.214
country_id: 290557
description:
2025-11-18 07:54:25 dovecot_login authenticator failed for ([80.227.138.214]) [80.227.138.214]:36565: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<wR/pSdxDRsyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 07:54:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@alcantaraemonteiro.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<fD/kSdxDNrZ2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.39.106
country_id: 1814991
description:
2025-11-18 07:54:45 dovecot_login authenticator failed for ([219.139.39.106]) [219.139.39.106]:58102: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-18 07:54:48 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:64551: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-11-18 07:54:11 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:46632: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-11-18 07:56:00 dovecot_login authenticator failed for (189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:57383: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 07:56:01 dovecot_login authenticator failed for (User) [177.74.174.120]:49447: 535 Incorrect authentication data (set_id=camila@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.3.36.154
country_id: 298795
description:
2025-11-18 07:55:24 dovecot_login authenticator failed for ([95.3.36.154]) [95.3.36.154]:60449: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TUGHTdxDIOuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 07:55:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<DACZTtxDnrprhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.111.2
country_id: 1562822
description:
2025-11-18 07:55:55 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:46112: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.52.210
country_id: 1269750
description:
2025-11-18 07:56:05 dovecot_login authenticator failed for ([103.68.52.210]) [103.68.52.210]:60370: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 07:55:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<K8zhS9xDFcl3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 07:55:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<F27qTNxDhGeKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 07:56:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<Oy3LT9xDiN2YNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-11-18 07:56:16 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:56645: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 18 07:57:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@prolip.com.br>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<Tt2WUtxDXpmiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-11-18 07:57:05 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:60820: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 07:56:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<Y1edT9xD1uxo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 07:56:17 dovecot_login authenticator failed for (User) [177.74.174.120]:49447: 535 Incorrect authentication data (set_id=camila@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 07:56:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<cWLlUNxDkLTBl4nP>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mkUVUdxDJpuxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ziivVNxDmLexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.178
country_id: 1269750
description:
2025-11-18 07:57:34 dovecot_login authenticator failed for ([182.95.46.178]) [182.95.46.178]:33034: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 182.75.215.245
country_id: 1269750
description:
Nov 18 07:57:33 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andre.nascimento>, method=PLAIN, rip=182.75.215.245, lip=200.150.196.245, TLS, session=<qTt9U9xDyoC2S9f1>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.74.225.186
country_id: 390903
description:
Nov 18 07:57:10 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andre.nascimento@calcautomacao.com.br>, method=PLAIN, rip=62.74.225.186, lip=200.150.196.245, session=<XCAuU9xD+8Y+SuG6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.196.141
country_id: 1819730
description:
2025-11-18 07:57:21 dovecot_login authenticator failed for 42-200-196-141.static.imsbiz.com [42.200.196.141]:60810: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
country_id: 99237
description:
2025-11-18 07:57:31 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:42088: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:58:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yf9wVtxDNtOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.65.108
country_id: 2077456
description:
2025-11-18 07:58:06 dovecot_login authenticator failed for ([120.157.65.108]) [120.157.65.108]:42546: 535 Incorrect authentication data (set_id=compras@highqualityautoparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-18 07:58:46 dovecot_plain authenticator failed for (bolvings) [90.160.139.163]:49411: 535 Incorrect authentication data (set_id=design@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.37.40.218
country_id: 6252001
description:
2025-11-18 07:58:50 dovecot_plain authenticator failed for c-68-37-40-218.hsd1.mi.comcast.net (colows) [68.37.40.218]:48812: 535 Incorrect authentication data (set_id=design@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.211.39.86
country_id: 1814991
description:
2025-11-18 07:58:50 dovecot_login authenticator failed for ([58.211.39.86]) [58.211.39.86]:46460: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 07:58:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<mce3WdxDeKul0iHB>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Ozg/WNxD2uyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 07:58:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@highqualityautoparts.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<GJ3qWNxDkIo+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.119.139
country_id: 2661886
description:
2025-11-18 07:58:56 dovecot_login authenticator failed for 78-66-119-139-no600.tbcn.telia.com [78.66.119.139]:41626: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.121.234.5
country_id: 1814991
description:
2025-11-18 07:58:22 dovecot_login authenticator failed for ([118.121.233.158]) [118.121.234.5]:34052: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 07:58:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<b+/oV9xDbtqElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.205.20.70
country_id: 6251999
description:
2025-11-18 07:58:35 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:50635: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 07:59:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<XnzRWtxDeqwO4dKR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.66.178.169
country_id: 2017370
description:
2025-11-18 07:59:28 dovecot_login authenticator failed for ([95.66.178.169]) [95.66.178.169]:38069: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-18 07:59:31 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:46442: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 07:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<benLW9xDCKWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2025-11-18 08:00:03 dovecot_login authenticator failed for 89-67-37-52.dynamic.play.pl [89.67.37.52]:54246: 535 Incorrect authentication data (set_id=contato@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.166.62
country_id: 2017370
description:
2025-11-18 07:59:10 dovecot_login authenticator failed for (dynamicip-109-195-166-62.pppoe.ryazan.ertelecom.ru) [109.195.166.62]:60502: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.75.186
country_id: 1835841
description:
2025-11-18 07:59:42 dovecot_login authenticator failed for ([59.6.75.186]) [59.6.75.186]:59586: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.155.199.176
country_id: 3469034
description:
Nov 18 08:00:02 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, session=<4xyUXdxDf/mxm8ew>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
country_id: 2017370
description:
2025-11-18 07:59:20 dovecot_login authenticator failed for (77x106x78x215.dynamic.barnaul.ertelecom.ru) [77.106.78.215]:64443: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 07:59:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<X3ZwXNxD/pNAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.101
country_id: 1668284
description:
2025-11-18 07:59:20 dovecot_login authenticator failed for 110-25-104-101.adsl.fetnet.net [110.25.104.101]:48660: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.155.199.176
country_id: 3469034
description:
Nov 18 08:00:01 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=<rLORXdxDRvmxm8ew>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.252.21.240
country_id: 1562822
description:
2025-11-18 07:59:43 dovecot_login authenticator failed for (static.vnpt-hanoi.com.vn) [222.252.21.240]:58924: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 61.136.142.13
country_id: 1814991
description:
Nov 18 08:01:06 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<info>, method=PLAIN, rip=61.136.142.13, lip=200.150.196.245, TLS, session=<6DXrX9xDOpg9iI4N>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.165.187
country_id: 2017370
description:
Nov 18 08:00:17 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<info@lixadoracuritiba.com.br>, method=PLAIN, rip=178.216.165.187, lip=200.150.196.245, session=<LXNMXtxDQNiy2KW7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 08:00:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<KLp7XtxD2KokMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.152
country_id: 1668284
description:
2025-11-18 08:00:30 dovecot_login authenticator failed for 110-25-112-152.adsl.fetnet.net [110.25.112.152]:46365: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 08:00:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<WMiXX9xDtHqnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.10.38.108
country_id: 1814991
description:
2025-11-18 08:00:43 dovecot_login authenticator failed for ([175.10.38.108]) [175.10.38.108]:49046: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 08:01:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<EM4BYdxDsMYI1et7>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4WxqX9xDqMSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 35.130.111.146
country_id: 6252001
description:
Nov 18 08:00:37 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<info@lixadoracuritiba.com.br>, method=PLAIN, rip=35.130.111.146, lip=200.150.196.245, TLS, session=<Dd+ZXtxD2Jgjgm+S>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 08:00:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<cwaXYNxDDJKkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2025-11-18 08:00:08 dovecot_login authenticator failed for ([123.209.106.190]) [123.209.106.190]:43286: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 08:00:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<95UIX9xDwCeKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.233.210.188
country_id: 6252001
description:
2025-11-18 08:00:38 dovecot_login authenticator failed for d-24-233-210-188.md.cpe.atlanticbb.net [24.233.210.188]:53386: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.149.67.200
country_id: 1814991
description:
2025-11-18 08:00:21 dovecot_login authenticator failed for ([182.149.67.200]) [182.149.67.200]:44696: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-11-18 08:01:34 dovecot_login authenticator failed for ([61.2.44.54]) [61.2.44.54]:47788: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.13
country_id: 1269750
description:
2025-11-18 08:01:42 dovecot_login authenticator failed for (nsg-corporate-13.226.187.122.airtel.in) [122.187.226.13]:52153: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 08:02:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<SWSGZNxDTp+B4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 08:01:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fernandotonet.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<6QKJYdxDWMV2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 08:01:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<3OCaYdxDKLotPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.42.206.123
country_id: 357994
description:
2025-11-18 08:01:48 dovecot_login authenticator failed for ([41.65.118.172]) [41.42.206.123]:56692: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-11-18 08:01:53 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:40443: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.194.136.3
country_id: 1668284
description:
2025-11-18 08:01:57 dovecot_login authenticator failed for 123-194-136-3.dynamic.kbronet.com.tw [123.194.136.3]:39812: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 08:01:27 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52267: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2025-11-18 08:01:43 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:40214: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-11-18 08:02:03 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:41406: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2025-11-18 08:02:03 dovecot_login authenticator failed for ([182.95.222.178]) [182.95.222.178]:57432: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 08:01:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<kmfnYdxDkpiUcQQF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BH/7YtxDVtyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.202
country_id: 1269750
description:
2025-11-18 08:02:24 dovecot_login authenticator failed for ([152.52.244.202]) [152.52.244.202]:46312: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2025-11-18 08:02:45 dovecot_login authenticator failed for ([14.54.22.11]) [14.54.22.11]:47906: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.107.0.188
country_id: 1814991
description:
2025-11-18 08:02:51 dovecot_login authenticator failed for ([218.107.0.188]) [218.107.0.188]:35578: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.59.34.5
country_id: 1814991
description:
2025-11-18 08:02:20 dovecot_login authenticator failed for ([113.59.34.8]) [113.59.34.5]:52305: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-18 08:02:21 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:53588: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<U9yNZtxDDI2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.55.3.238
country_id: 2017370
description:
2025-11-18 08:02:50 dovecot_login authenticator failed for ([92.55.3.238]) [92.55.3.238]:63892: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kyhbaNxDyJixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.142.148.162
country_id: 1168579
description:
2025-11-18 08:03:02 dovecot_login authenticator failed for ([202.142.148.162]) [202.142.148.162]:33675: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-11-18 08:02:11 dovecot_login authenticator failed for (syn-172-090-128-097.res.spectrum.com) [172.90.128.97]:52783: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 08:02:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<y9HvZdxDLMYXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.108.150
country_id: 1668284
description:
2025-11-18 08:03:32 dovecot_login authenticator failed for (175-182-108-150.adsl.dynamic.seed.net.tw) [175.182.108.150]:55838: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.3.1
country_id: 2510769
description:
2025-11-18 08:03:58 dovecot_login authenticator failed for 1.red-81-43-3.staticip.rima-tde.net [81.43.3.1]:37734: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-11-18 08:03:17 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:59455: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 08:03:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<R6pUadxDVIsI2Cjk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 08:03:28 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:61419: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8JsbatxDlKmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2025-11-18 08:03:41 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:36754: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 08:04:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<PvbMa9xDBIfSchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 08:04:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<EMvfa9xDzpdns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.5.129.68
country_id: 3017382
description:
2025-11-18 08:03:22 dovecot_plain authenticator failed for 68.129.5.84.rev.sfr.net (spling) [84.5.129.68]:58750: 535 Incorrect authentication data (set_id=design@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-11-18 08:03:25 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (humon) [174.59.253.88]:58686: 535 Incorrect authentication data (set_id=design@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 08:04:08 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:53606: 535 Incorrect authentication data (set_id=administrativo2@cleservicosindustriais.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FUOsbdxDNMqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 08:04:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<yT7YbtxD9MlSnOdL>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yNFAcdxDvuWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 18 08:05:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<Ct2lcdxDFs4zTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.241.228.34
country_id: 1269750
description:
2025-11-18 08:05:47 dovecot_login authenticator failed for ([115.241.228.34]) [115.241.228.34]:53022: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 08:05:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<8G4tctxDKoeUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 08:05:33 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51976: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-11-18 08:05:33 dovecot_login authenticator failed for ([203.172.213.166]) [203.172.213.166]:53582: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.62
country_id: 1814991
description:
2025-11-18 08:05:59 dovecot_login authenticator failed for ([125.90.72.62]) [125.90.72.62]:34370: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.192.75.11
country_id: 1814991
description:
2025-11-18 08:06:00 dovecot_login authenticator failed for ([220.192.75.11]) [220.192.75.11]:35736: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<C0YRc9xD7IyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-11-18 08:06:17 dovecot_plain authenticator failed for (apiciumist) [46.8.245.34]:39368: 535 Incorrect authentication data (set_id=info@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 08:06:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<XSyHdNxDCtGkXF7M>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dqzUdNxD3JyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.143.133.126
country_id: 3595528
description:
2025-11-18 08:06:13 dovecot_login authenticator failed for ([190.143.133.126]) [190.143.133.126]:57364: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.129.34.91
country_id: 1835841
description:
2025-11-18 08:07:09 dovecot_login authenticator failed for ([121.129.34.91]) [121.129.34.91]:47348: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.169.28.244
country_id: 2017370
description:
2025-11-18 08:07:10 dovecot_plain authenticator failed for 28.244.inn361.ru (emend) [193.169.28.244]:52287: 535 Incorrect authentication data (set_id=info@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 08:07:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<dgdQd9xDqLY+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 08:07:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<k6zEd9xDJNel0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-11-18 08:07:38 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:32241: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 08:07:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<lSbIeNxDIpVzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-18 08:07:21 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:49205: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8zpreNxDssKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.16.71.254
country_id: 6252001
description:
2025-11-18 08:07:50 dovecot_login authenticator failed for ([209.16.71.254]) [209.16.71.254]:63680: 535 Incorrect authentication data (set_id=sandromiguel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-11-18 08:07:55 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:40914: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
country_id: 2017370
description:
2025-11-18 08:08:07 dovecot_login authenticator failed for (77x106x78x215.dynamic.barnaul.ertelecom.ru) [77.106.78.215]:12362: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 08:08:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<376+e9xDUtXSchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 08:08:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<6JX4e9xDVueB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.219.232.34
country_id: 1835841
description:
2025-11-18 08:08:51 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:53625: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
country_id: 1668284
description:
2025-11-18 08:08:54 dovecot_login authenticator failed for ([101.13.5.49]) [101.13.5.49]:55748: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 08:09:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<2oTxfdxDUu1SczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 08:08:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<CA7OetxDKKtA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.39
country_id: 1814991
description:
2025-11-18 08:08:23 dovecot_login authenticator failed for ([111.26.62.39]) [111.26.62.39]:40858: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.236.187.43
country_id: 2017370
description:
2025-11-18 08:09:06 dovecot_login authenticator failed for (p187-43.samaralan.ru) [85.236.187.43]:51600: 535 Incorrect authentication data (set_id=cpanel)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<pzgHfNxDCuCxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<N/XDfdxDlIGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-11-18 08:09:50 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:36734: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-18 08:09:22 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:5962: 535 Incorrect authentication data (set_id=info@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.36.7.89
country_id: 2017370
description:
2025-11-18 08:09:31 dovecot_login authenticator failed for ([78.36.7.89]) [78.36.7.89]:35011: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TPGOf9xDTo2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.220
country_id: 1835841
description:
2025-11-18 08:09:33 dovecot_login authenticator failed for ([211.116.107.220]) [211.116.107.220]:47246: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 08:09:41 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:64657: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.117.232.42
country_id: 2017370
description:
2025-11-18 08:09:17 dovecot_login authenticator failed for ([85.117.232.42]) [85.117.232.42]:54264: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 08:09:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<fHlXf9xD2mOnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-11-18 08:09:31 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:53310: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.128.151.92
country_id: 6252001
description:
2025-11-18 08:09:49 dovecot_login authenticator failed for c-73-128-151-92.hsd1.de.comcast.net [73.128.151.92]:33312: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 18 08:09:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<Cgh8gNxDyNUIiXsk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.21.209.27
country_id: 1814991
description:
2025-11-18 08:09:08 dovecot_login authenticator failed for ([60.21.209.27]) [60.21.209.27]:50067: 535 Incorrect authentication data (set_id=rogerioamorim@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.176.252
country_id: 1814991
description:
2025-11-18 08:09:29 dovecot_login authenticator failed for ([61.184.176.252]) [61.184.176.252]:49098: 535 Incorrect authentication data (set_id=rogerioamorim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2025-11-18 08:09:33 dovecot_login authenticator failed for ([121.142.165.111]) [121.142.165.111]:39210: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 08:09:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<wSOEftxD3LJ3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 08:09:26 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51834: 535 Incorrect authentication data (set_id=contato@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 08:11:07 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:52162: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.158
country_id: 1269750
description:
2025-11-18 08:10:13 dovecot_login authenticator failed for ([122.185.152.199]) [182.95.178.158]:53346: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-18 08:10:25 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:41574: 535 Incorrect authentication data (set_id=bruno)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ulUlg9xDwLKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 08:10:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<wtIdg9xDAuSGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.92.187.68
country_id: 6252001
description:
2025-11-18 08:11:51 dovecot_login authenticator failed for ([172.92.187.68]) [172.92.187.68]:52128: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-18 08:11:56 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:35376: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dtuFiNxDlOSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.95.112
country_id: 1835841
description:
2025-11-18 08:11:09 dovecot_login authenticator failed for ([121.171.95.112]) [121.171.95.112]:60750: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.51.87.9
country_id: 1814991
description:
2025-11-18 08:11:31 dovecot_login authenticator failed for ([59.51.87.9]) [59.51.87.9]:34240: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3m3BhtxDmNWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.10.156.230
country_id: 1819730
description:
Nov 18 08:12:09 hosting dovecot: imap-login: Disconnected: Connection closed: read(size=368) failed: Connection reset by peer (user disabled): user=<misterthomas@adlondrina.com.br>, method=PLAIN, rip=113.10.156.230, lip=200.150.196.245, TLS: read(size=368) failed: Connection reset by peer, session=<KkTCh9xDFfRxCpzm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-18 08:12:52 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:40048: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2025-11-18 08:12:40 dovecot_plain authenticator failed for (cappe) [95.79.108.51]:43661: 535 Incorrect authentication data (set_id=info@fkrepresentacoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-18 08:12:39 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:52276: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-18 08:12:49 H=(195.3.134.135) [179.0.178.53]:50370 F=<erictremblaysi@hotmail.com> rejected RCPT <microcon@transol.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:50370 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.19
country_id: 2186224
description:
2025-11-18 08:12:55 dovecot_login authenticator failed for ([121.73.163.19]) [121.73.163.19]:47884: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 08:12:14 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51435: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.42.171.206
country_id: 6252001
description:
2025-11-18 08:12:21 dovecot_login authenticator failed for (100.42.171.206.douglasfast.net) [100.42.171.206]:38087: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9XpIitxDsIKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 18 08:13:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<WirCjNxDlJ+dQi/y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
country_id: 1835841
description:
2025-11-18 08:13:18 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:40262: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 08:13:43 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51957: 535 Incorrect authentication data (set_id=curitiba@asscar.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 08:13:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<lR1gj9xDvKov7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.82.135.154
country_id: 1814991
description:
2025-11-18 08:14:06 dovecot_login authenticator failed for ([1.82.135.154]) [1.82.135.154]:39934: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.15.216.41
country_id: 6252001
description:
2025-11-18 08:13:12 dovecot_plain authenticator failed for c-24-15-216-41.hsd1.il.comcast.net (refory) [24.15.216.41]:35206: 535 Incorrect authentication data (set_id=info@inovasite.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8GbhjdxDoquxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-18 08:13:07 dovecot_login authenticator failed for ([125.19.82.193]) [182.95.115.70]:38428: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MTFEk9xD/tmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 08:14:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<j3kmkNxDwKOl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-18 08:14:21 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:44446: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mR14kdxDVs+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.191.124.201
country_id: 1269750
description:
2025-11-18 08:14:33 dovecot_login authenticator failed for ([160.191.124.201]) [160.191.124.201]:54532: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 08:14:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@f5assessoria.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<b4wwktxDzs52wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.50.162.66
country_id: 2017370
description:
2025-11-18 08:14:20 dovecot_login authenticator failed for ([94.50.162.66]) [94.50.162.66]:48164: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.81.209.76
country_id: 2017370
description:
2025-11-18 08:14:38 dovecot_login authenticator failed for ([78.81.209.76]) [78.81.209.76]:48378: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.75
country_id: 99237
description:
2025-11-18 08:14:58 dovecot_login authenticator failed for ([65.20.175.75]) [65.20.175.75]:36254: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.30.253
country_id: 1814991
description:
2025-11-18 08:15:56 dovecot_login authenticator failed for ([112.27.30.253]) [112.27.30.253]:49339: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 08:16:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<YryqltxDzoSB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-11-18 08:15:18 dovecot_login authenticator failed for ([152.52.12.201]) [152.52.245.38]:42008: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<950OldxDiO2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.40.82
country_id: 2017370
description:
2025-11-18 08:15:33 dovecot_login authenticator failed for ([46.44.40.82]) [46.44.40.82]:56870: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 08:15:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<3P1VltxDgs0rmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2025-11-18 08:15:15 dovecot_login authenticator failed for ([111.26.63.86]) [111.26.63.87]:33890: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 18 08:15:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<crKQlNxDEpS317Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 08:16:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<p+v5l9xDzoeElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-11-18 08:16:30 dovecot_login authenticator failed for ([65.191.211.33]) [65.191.211.33]:48620: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<I32emNxDUJexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 08:16:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<rK62mdxDZuevfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 18 08:17:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<KDxFmtxDLN2WXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.111.2
country_id: 1562822
description:
2025-11-18 08:16:09 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:40564: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 08:16:48 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:65333: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0k8qnNxDQL+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-11-18 08:17:40 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-11-18 08:17:41 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:39511: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<nun+ndxD2tSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 08:18:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<e/vyndxDosCd5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 08:17:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@toromartelinho.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<uIbHmtxDLOdzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-11-18 08:17:25 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:35444: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 08:17:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<hKsondxDmuJA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2025-11-18 08:17:50 dovecot_login authenticator failed for ([83.239.84.130]) [83.239.84.130]:33768: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 08:18:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<4Ro0n9xDvrKYNbyQ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AULAn9xDeOexV3kv>


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 31.57.112.164
country_id: 3175395
description:
Nov 18 08:19:04 hosting pure-ftpd: (?@31.57.112.164) [WARNING] Authentication failed for user [inovasite]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.65.113
country_id: 597427
description:
Nov 18 08:19:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@transol.com.br>, method=PLAIN, rip=69.62.65.113, lip=200.150.196.245, session=<p66SodxDctBFPkFx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.115.29.39
country_id: 1835841
description:
2025-11-18 08:19:06 dovecot_login authenticator failed for ([175.115.29.39]) [175.115.29.39]:3186: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 31.57.112.164
country_id: 3175395
description:
Nov 18 08:18:14 hosting pure-ftpd: (?@31.57.112.164) [WARNING] Authentication failed for user [inovasite]


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 31.57.112.164
country_id: 3175395
description:
Nov 18 08:18:48 hosting pure-ftpd: (?@31.57.112.164) [WARNING] Authentication failed for user [inovasite]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 31.57.112.164
country_id: 3175395
description:
Nov 18 08:19:10 hosting pure-ftpd: (?@31.57.112.164) [WARNING] Authentication failed for user [inovasite]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hD5Xo9xDUpSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 08:19:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<SgiDo9xDhoBCYSpH>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 170.82.133.153
country_id: 3469034
description:
2025-11-18 08:19:39 H=(localhost) [170.82.133.153]:19111 F=<hello@localhost> rejected RCPT <z4LOeyk7kT95uwZ@asscar.com.br>: Sender verify failed


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 08:19:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<BoXwo9xD6tF9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-11-18 08:20:04 dovecot_login authenticator failed for ([122.184.143.81]) [182.95.47.2]:57716: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 08:20:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<LZklpdxDJrBns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.111.147.32
country_id: 2017370
description:
2025-11-18 08:19:22 dovecot_login authenticator failed for ([78.111.147.32]) [78.111.147.32]:49398: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 08:19:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<3JCtotxDqtKB4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 08:19:44 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52023: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 08:19:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<YY+1pNxDsd93xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.141
country_id: 1269750
description:
2025-11-18 08:19:09 dovecot_login authenticator failed for ([122.187.230.141]) [122.187.230.141]:49430: 535 Incorrect authentication data (set_id=info@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-18 08:19:19 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:49846: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2025-11-18 08:20:25 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:37712: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
country_id: 1269750
description:
2025-11-18 08:20:55 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:45510: 535 Incorrect authentication data (set_id=info@vidaengenharia.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 08:20:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<nCIkptxDdJ9n9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.28.219.20
country_id: 2510769
description:
2025-11-18 08:20:29 dovecot_login authenticator failed for 20.red-88-28-219.staticip.rima-tde.net [88.28.219.20]:33094: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<P8vsptxDpLGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.118.17.101
country_id: 2017370
description:
2025-11-18 08:20:43 dovecot_login authenticator failed for ([176.118.17.101]) [176.118.17.101]:46482: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.155.146.33
country_id: 2017370
description:
2025-11-18 08:20:47 dovecot_login authenticator failed for (ip-45-155-146-33.ip.asarta.ru) [45.155.146.33]:55388: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.238.101.209
country_id: 3932488
description:
2025-11-18 08:20:54 dovecot_login authenticator failed for ([190.238.101.209]) [190.238.101.209]:37742: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KnGuqNxDmMSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.22.130
country_id: 1562822
description:
2025-11-18 08:21:21 dovecot_login authenticator failed for ([124.197.22.130]) [124.197.22.130]:46116: 535 Incorrect authentication data (set_id=sandromiguel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2025-11-18 08:21:32 dovecot_login authenticator failed for (95.158.39.201.bestsolution.net.ua) [95.158.39.201]:37858: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 08:21:45 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:58143: 535 Incorrect authentication data (set_id=test@jacgeneralcleaning.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 61.136.142.13
country_id: 1814991
description:
Nov 18 08:22:05 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<info>, method=PLAIN, rip=61.136.142.13, lip=200.150.196.245, session=<puYxrNxDzF09iI4N>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-18 08:21:16 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:45414: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<oe99qtxDoNCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2025-11-18 08:21:50 dovecot_login authenticator failed for 111-70-32-10.emome-ip.hinet.net [111.70.32.10]:60927: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.233.235.203
country_id: 2661886
description:
2025-11-18 08:21:17 dovecot_login authenticator failed for 81-233-235-203-no600.tbcn.telia.com [81.233.235.203]:39520: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-18 08:21:54 dovecot_login authenticator failed for ([27.123.91.165]) [182.95.115.38]:52476: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.4.40.247
country_id: 6252001
description:
2025-11-18 08:21:55 dovecot_login authenticator failed for d4-50-247-40.try.wideopenwest.com [50.4.40.247]:49764: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.245.186.121
country_id: 1643084
description:
2025-11-18 08:21:17 dovecot_login authenticator failed for (ipv4-124-186-245-43.as55666.net) [43.245.186.121]:41542: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.187.229.194
country_id: 1269750
description:
Nov 18 08:21:46 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<info@lixadoracuritiba.com.br>, method=PLAIN, rip=122.187.229.194, lip=200.150.196.245, TLS, session=<mnn4qdxDqKB6u+XC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.245.232.31
country_id: 1814991
description:
2025-11-18 08:22:04 dovecot_login authenticator failed for ([183.245.232.31]) [183.245.232.31]:37712: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 08:21:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<s7KkqdxDcog7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.165
country_id: 3686110
description:
2025-11-18 08:21:22 dovecot_login authenticator failed for (Dinamic-Tigo186-97-203-165.tigo.com.co) [186.97.203.165]:36189: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
country_id: 2542007
description:
2025-11-18 08:21:12 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:35480: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.111.2
country_id: 1562822
description:
2025-11-18 08:21:25 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:46768: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-11-18 08:21:27 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:47664: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.17.163.44
country_id: 6252001
description:
2025-11-18 08:21:31 dovecot_login authenticator failed for (173-17-163-44.client.mchsi.com) [173.17.163.44]:48530: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.213.16
country_id: 732800
description:
2025-11-18 08:21:35 dovecot_login authenticator failed for 95-87-213-16.ip.btc-net.bg [95.87.213.16]:57191: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.194.166
country_id: 1269750
description:
2025-11-18 08:22:00 dovecot_login authenticator failed for ([125.19.175.13]) [125.19.194.166]:33470: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-11-18 08:21:41 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:50748: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 08:21:11 dovecot_login authenticator failed for (User) [177.74.174.120]:63840: 535 Incorrect authentication data (set_id=camila@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-18 08:21:45 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:49380: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2025-11-18 08:22:08 dovecot_login authenticator failed for fs96f9fced.tkyc203.ap.nuro.jp [150.249.252.237]:59727: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.195.94.243
country_id: 2017370
description:
2025-11-18 08:22:17 dovecot_login authenticator failed for ([217.195.94.243]) [217.195.94.243]:53276: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-18 08:22:30 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:35518: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<LQkQrtxDDIixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.198.128.124
country_id: 1835841
description:
2025-11-18 08:22:34 dovecot_login authenticator failed for ([211.198.128.124]) [211.198.128.124]:38309: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.179.135.174
country_id: 2661886
description:
2025-11-18 08:22:08 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:35485: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-11-18 08:22:20 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:39526: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 5.32.61.6
country_id: 290557
description:
Nov 18 08:22:27 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<info>, method=PLAIN, rip=5.32.61.6, lip=200.150.196.245, TLS, session=<42uSrNxDN4QFID0G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.234.135.54
country_id: 1562822
description:
2025-11-18 08:22:48 dovecot_login authenticator failed for (125.234.135.54.hcm.viettel.vn) [125.234.135.54]:43742: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.20.106.40
country_id: 2017370
description:
2025-11-18 08:22:53 dovecot_login authenticator failed for (89.20.106.40.permonline.ru) [89.20.106.40]:36838: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.227.51
country_id: 1835841
description:
2025-11-18 08:23:54 dovecot_login authenticator failed for ([61.79.227.51]) [61.79.227.51]:39944: 535 Incorrect authentication data (set_id=eleicoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.177.216
country_id: 1814991
description:
2025-11-18 08:23:56 dovecot_login authenticator failed for ([111.26.177.215]) [111.26.177.216]:50384: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cqRvs9xDxLqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-18 08:23:08 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:42664: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 08:23:18 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52037: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OeKfsdxDKKixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.177.110
country_id: 1835841
description:
2025-11-18 08:23:34 dovecot_login authenticator failed for ([222.108.177.110]) [222.108.177.110]:53827: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 08:23:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<HSbwsNxD6LJxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
country_id: 1814991
description:
2025-11-18 08:23:37 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:50888: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.94.168.28
country_id: 3469034
description:
[2025-11-18 08:24:02 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 08:24:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<6kJ7tNxD6Ig+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 08:24:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@oabsjp.org.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<EFmjtNxDQM12wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 08:24:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<Rn+VtNxDTLAkMrBu>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FzI9tdxDGMuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 08:25:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<Ek/WttxDPqx9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.116.150
country_id: 1835841
description:
2025-11-18 08:25:03 dovecot_login authenticator failed for ([121.168.116.150]) [121.168.116.150]:54215: 535 Incorrect authentication data (set_id=rebecakessler@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 08:26:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<S0xjutxDwN1xoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.141.77.192
country_id: 2017370
description:
2025-11-18 08:26:02 dovecot_login authenticator failed for ppp85-141-77-192.pppoe.mtu-net.ru [85.141.77.192]:44086: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.94.121.82
country_id: 1835841
description:
2025-11-18 08:25:38 dovecot_login authenticator failed for ([115.94.121.82]) [115.94.121.82]:50809: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 08:25:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<Yv4rudxDGKiP9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2025-11-18 08:25:39 dovecot_plain authenticator failed for c-24-91-103-202.hsd1.ma.comcast.net (blingra) [24.91.103.202]:49560: 535 Incorrect authentication data (set_id=inovasite.com@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.59.253.88
country_id: 6252001
description:
2025-11-18 08:25:43 dovecot_plain authenticator failed for c-174-59-253-88.hsd1.pa.comcast.net (unkeed) [174.59.253.88]:52528: 535 Incorrect authentication data (set_id=inovasite.com@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-11-18 08:25:45 dovecot_login authenticator failed for ([128.185.242.74]) [128.185.242.74]:35076: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 08:26:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<OGp3utxD9Ndns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BmvLuNxDDu2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 08:25:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@primiciapersianas.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<d2ccudxDZMOkXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.194.136.3
country_id: 1668284
description:
2025-11-18 08:26:30 dovecot_login authenticator failed for 123-194-136-3.dynamic.kbronet.com.tw [123.194.136.3]:40568: 535 Incorrect authentication data (set_id=rene)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WV1cvNxDQKGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2025-11-18 08:26:36 dovecot_login authenticator failed for (187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:35253: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 08:26:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<0OHNvdxD6pJvAEul>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 08:26:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<s74Ou9xDkOYXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.105.52.153
country_id: 2017370
description:
2025-11-18 08:26:14 dovecot_login authenticator failed for ([95.105.52.153]) [95.105.52.153]:53394: 535 Incorrect authentication data (set_id=rene@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-11-18 08:26:15 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:45088: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.17.38
country_id: 3469034
description:
2025-11-18 08:26:24 dovecot_login authenticator failed for ([186.239.246.145]) [187.8.17.38]:57987: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2025-11-18 08:26:13 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:42494: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fGouvtxDGK6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.72
country_id: 2300660
description:
2025-11-18 08:27:04 dovecot_login authenticator failed for ([197.251.249.72]) [197.251.249.72]:40331: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 08:27:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<g1FDvtxD7JKd5hjP>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EAXzv9xDzrmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 08:27:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fernandotonet.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<wgXsv9xDFKSkXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Nov 18 08:27:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomation.com>, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=<uik2wdxDOqfBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.6.226.122
country_id: 1562822
description:
2025-11-18 08:27:25 dovecot_login authenticator failed for ([117.6.226.122]) [117.6.226.122]:38407: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 08:28:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<TcPgxNxDbKpAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-18 08:29:01 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (synasts) [87.103.126.54]:31752: 535 Incorrect authentication data (set_id=admin@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 08:28:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<s8oQw9xDlqRn9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fE2Dw9xD7tmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 08:28:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<ZteMw9xDqIxrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 08:28:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<esWIw9xDZOlw2eny>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.233.210.188
country_id: 6252001
description:
2025-11-18 08:28:46 dovecot_login authenticator failed for d-24-233-210-188.md.cpe.atlanticbb.net [24.233.210.188]:54506: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.25.58.19
country_id: 1643084
description:
2025-11-18 08:29:52 dovecot_login authenticator failed for ([160.25.58.19]) [160.25.58.19]:39738: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 08:29:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<AmPKx9xDvrfBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.59.26
country_id: 1269750
description:
2025-11-18 08:29:53 dovecot_login authenticator failed for ([125.23.125.209]) [122.187.59.26]:36962: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 08:30:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<S4e5yNxDUJ0tPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 08:29:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<UyvSxtxDPKNns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 08:29:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<Ancex9xD5JGGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.48.70
country_id: 3469034
description:
2025-11-18 08:29:54 dovecot_login authenticator failed for ([187.12.48.70]) [187.12.48.70]:34708: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 186.235.124.8
country_id: 3469034
description:
2025-11-18 08:29:19 H=(localhost) [186.235.124.8]:44407 F=<hello@localhost> rejected RCPT <iD0l6WT76jnRLRW@adlondrina.com.br>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.102.226.83
country_id: 2264397
description:
2025-11-18 08:29:26 dovecot_login authenticator failed for (93.102.226.83.rev.optimus.pt) [93.102.226.83]:51677: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-11-18 08:29:44 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:47602: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6LbkyNxDKJixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 08:29:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<qllOxtxDvutCYSpH>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:29:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vRAjx9xDKIuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.55.99.226
country_id: 390903
description:
2025-11-18 08:30:52 dovecot_login authenticator failed for ppp005055099226.access.hol.gr [5.55.99.226]:43616: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.143.133.126
country_id: 3595528
description:
2025-11-18 08:30:21 dovecot_login authenticator failed for ([190.143.133.126]) [190.143.133.126]:51603: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.162.117
country_id: 2017370
description:
2025-11-18 08:30:42 dovecot_login authenticator failed for broadband-77-37-162-117.ip.moscow.rt.ru [77.37.162.117]:59302: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JuWpytxDOq2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2025-11-18 08:30:38 dovecot_login authenticator failed for ([121.73.169.149]) [121.73.169.149]:39690: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.230.138.34
country_id: 3017382
description:
[2025-11-18 08:30:55 -0300] info [cpaneld] 185.230.138.34 - lixadora "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lixadora (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.146.28.230
country_id: 2017370
description:
2025-11-18 08:31:05 dovecot_login authenticator failed for (host91-146-28-230.etth.mark-itt.net) [91.146.28.230]:60000: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 08:30:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<BpelydxDaKs+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 08:30:18 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51970: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-11-18 08:30:57 dovecot_login authenticator failed for ([27.123.105.140]) [182.95.47.2]:57044: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.92.115.73
country_id: 6252001
description:
2025-11-18 08:30:12 dovecot_login authenticator failed for ([168.92.115.73]) [168.92.115.73]:37627: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-18 08:30:30 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:55628: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 08:30:20 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:52550: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.40.54
country_id: 2510769
description:
2025-11-18 08:31:18 dovecot_login authenticator failed for (cli-5b7e2836.wholesale.adamo.es) [91.126.40.54]:36825: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-11-18 08:31:38 dovecot_login authenticator failed for ([189.108.156.41]) [187.8.64.94]:52152: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.166.87.145
country_id: 1814991
description:
2025-11-18 08:31:41 dovecot_login authenticator failed for ([223.166.87.145]) [223.166.87.145]:34632: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.11.230.160
country_id: 2510769
description:
2025-11-18 08:31:50 dovecot_login authenticator failed for 160.red-88-11-230.dynamicip.rima-tde.net [88.11.230.160]:59763: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.5.83.207
country_id: 2017370
description:
2025-11-18 08:31:52 dovecot_login authenticator failed for 81.5.83.207.dhcp.mipt-telecom.ru [81.5.83.207]:31934: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.204.32
country_id: 1814991
description:
2025-11-18 08:32:03 dovecot_login authenticator failed for ([220.180.204.32]) [220.180.204.32]:43294: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.63.174
country_id: 2017370
description:
2025-11-18 08:31:31 dovecot_login authenticator failed for ([188.247.63.174]) [188.247.63.174]:52876: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.2.243.174
country_id: 1814991
description:
2025-11-18 08:31:41 dovecot_login authenticator failed for (sindeesfort.com.br) [60.2.243.174]:52280: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 18 08:31:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<yo35ztxDenUkMrGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 08:32:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<DyXbz9xDGrsnaoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 08:31:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<Ims6zdxD2rUv+yzS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:31:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cElJztxDtMmxV3kv>


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 39.41.232.228
country_id: 1168579
description:
Nov 18 08:31:43 hosting pure-ftpd: (?@39.41.232.228) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 08:31:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<b4FWz9xDVshSnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 08:32:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<8Jwv0NxDWENo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
country_id: 1819730
description:
2025-11-18 08:31:21 dovecot_login authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:50383: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 08:32:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<JAOn0dxDqpUrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.49
country_id: 3996063
description:
2025-11-18 08:32:31 dovecot_login authenticator failed for (189.218.82.49-clientes-izzi.mx) [189.218.82.49]:42482: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YfbZ0dxDCuexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.250.9.98
country_id: 2017370
description:
2025-11-18 08:32:50 dovecot_login authenticator failed for host87-250-9-098.etth.mark-itt.net [87.250.9.98]:41716: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</8SY09xDeISxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 08:32:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<uMPR0NxD4KJvAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.2.243.174
country_id: 1814991
description:
2025-11-18 08:32:21 dovecot_login authenticator failed for (sindeesfort.com.br) [60.2.243.174]:53418: 535 Incorrect authentication data (set_id=admin@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 08:32:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<xJP60dxDfdx3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.51.205.170
country_id: 6252001
description:
2025-11-18 08:32:39 dovecot_login authenticator failed for pool-108-51-205-170.washdc.fios.verizon.net [108.51.205.170]:42924: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 08:32:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<yOVK0NxDtCevfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 08:33:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<ESxJ1dxDzqWl0xnK>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<a9Bo1dxDXpaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 08:33:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<gNa01dxDsBaKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 08:33:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<AJvL1dxDMrZn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-11-18 08:33:47 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:39792: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2025-11-18 08:33:57 dovecot_login authenticator failed for 77-173-41-213.cust.keyyo.net [213.41.173.77]:36838: 535 Incorrect authentication data (set_id=vendas3@singseguros.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 18 08:34:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<lLLG19xDz55bejg7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-11-18 08:34:19 dovecot_login authenticator failed for (120-194-136-45.ddns.movitel.tv) [45.136.194.120]:57180: 535 Incorrect authentication data (set_id=vendas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2025-11-18 08:34:44 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:55756: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-11-18 08:34:11 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:49262: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 08:34:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<Tpi819xDVrYnaoFh>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-18 08:34:17 H=(195.3.134.135) [179.0.178.53]:65184 F=<erictremblaysi@hotmail.com> rejected RCPT <rodnei@box911.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:65184 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.245.141.225
country_id: 2077456
description:
2025-11-18 08:34:32 dovecot_login authenticator failed for 61-245-141-225.3df58d.per.nbn.aussiebb.net [61.245.141.225]:53141: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hnP22NxDGK6xV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:35:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gmOX3NxDVMaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 08:35:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<5RDA3NxDaOVCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.184.83.17
country_id: 6252001
description:
2025-11-18 08:35:40 dovecot_login authenticator failed for (h17.83.184.173.dynamic.ip.windstream.net) [173.184.83.17]:34298: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zPdZ3txDftWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.100.48
country_id: 1814991
description:
2025-11-18 08:35:27 dovecot_login authenticator failed for ([36.135.100.47]) [36.135.100.48]:59720: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 08:35:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<8S013NxDWtJ3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 08:35:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<unU33NxDVNBo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 08:36:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<GWtk4NxDSOaElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 08:36:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<PVC139xD/KFA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 08:36:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<f7gq4NxDZOhrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 08:36:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<l2Qj4NxD1r2P9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.86
country_id: 1269750
description:
2025-11-18 08:36:58 dovecot_login authenticator failed for ([27.123.119.191]) [122.184.127.86]:38784: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-18 08:36:25 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:43698: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mNAn4NxDkuCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-11-18 08:36:38 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:33710: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2025-11-18 08:37:46 dovecot_plain authenticator failed for (prompaist) [76.190.155.43]:42886: 535 Incorrect authentication data (set_id=design.user.finance@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2025-11-18 08:37:49 dovecot_plain authenticator failed for c-73-53-254-168.hsd1.fl.comcast.net (rialiblury) [73.53.254.168]:39560: 535 Incorrect authentication data (set_id=design.user.finance@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.247.230.132
country_id: 2264397
description:
2025-11-18 08:38:06 dovecot_login authenticator failed for bl14-230-132.dsl.telepac.pt [85.247.230.132]:39246: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.41.156.64
country_id: 2017370
description:
2025-11-18 08:37:27 dovecot_login authenticator failed for ([77.41.156.64]) [77.41.156.64]:54542: 535 Incorrect authentication data (set_id=atualizacoes1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<s1O949xDLI6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 08:39:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<BLkK6dxDetKKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 08:38:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<GhK75txDGqnBl4nP>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<jlNG59xDfqOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.246
country_id: 1668284
description:
2025-11-18 08:38:41 dovecot_login authenticator failed for 111-70-23-246.emome-ip.hinet.net [111.70.23.246]:38748: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 08:38:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<LuK759xDDuFAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.169.37.163
country_id: 2077456
description:
2025-11-18 08:38:53 dovecot_login authenticator failed for (cpe-58-169-37-163.wb02.wa.asp.telstra.net) [58.169.37.163]:58718: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EswU6dxD6LSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2025-11-18 08:39:15 dovecot_login authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:62190: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:39:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kz3l6txDAsSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.78.112.81
country_id: 1814991
description:
2025-11-18 08:40:05 dovecot_login authenticator failed for ([218.78.112.81]) [218.78.112.81]:50798: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 08:39:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<gAcB69xDYGOnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 08:39:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<iadJ69xDgKotPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.39
country_id: 2750405
description:
2025-11-18 08:39:54 dovecot_login authenticator failed for ([45.148.10.39]) [45.148.10.39]:65467: 535 Incorrect authentication data (set_id=default)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2025-11-18 08:40:02 dovecot_login authenticator failed for syn-024-105-160-100.biz.spectrum.com [24.105.160.100]:32842: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-11-18 08:40:05 dovecot_login authenticator failed for ([196.191.142.67]) [196.191.142.67]:41266: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-11-18 08:40:31 dovecot_login authenticator failed for ([125.16.31.25]) [152.52.236.122]:47124: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.30
country_id: 2750405
description:
2025-11-18 08:40:57 dovecot_login authenticator failed for ([45.148.10.30]) [45.148.10.30]:59590: 535 Incorrect authentication data (set_id=bob)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.47
country_id: 1168579
description:
2025-11-18 08:40:57 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:33175: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.31
country_id: 2750405
description:
2025-11-18 08:41:01 dovecot_login authenticator failed for ([45.148.10.31]) [45.148.10.31]:52286: 535 Incorrect authentication data (set_id=daniel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-11-18 08:41:00 dovecot_plain authenticator failed for ool-44c19558.dyn.optonline.net (anthionpil) [68.193.149.88]:45476: 535 Incorrect authentication data (set_id=design@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.89.135.30
country_id: 2017370
description:
2025-11-18 08:41:02 dovecot_login authenticator failed for ([152.89.135.30]) [152.89.135.30]:35414: 535 Incorrect authentication data (set_id=kgl)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 08:40:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<Lkru7NxDjtUO4dKR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.29
country_id: 2750405
description:
2025-11-18 08:40:36 dovecot_login authenticator failed for ([45.148.10.29]) [45.148.10.29]:51846: 535 Incorrect authentication data (set_id=administrator)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 08:40:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<WQfl7txDaqUtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.125.68.208
country_id: 1835841
description:
2025-11-18 08:40:16 dovecot_login authenticator failed for ([175.125.68.208]) [175.125.68.208]:46687: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<q65r7txDiu2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.25
country_id: 2750405
description:
2025-11-18 08:40:18 dovecot_login authenticator failed for ([45.148.10.25]) [45.148.10.25]:65465: 535 Incorrect authentication data (set_id=intranet)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.26
country_id: 2750405
description:
2025-11-18 08:40:19 dovecot_login authenticator failed for ([45.148.10.26]) [45.148.10.26]:52141: 535 Incorrect authentication data (set_id=1111)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
country_id: 1819730
description:
2025-11-18 08:40:29 dovecot_login authenticator failed for (223-197-153-138.static.imsbiz.com) [223.197.153.138]:50374: 535 Incorrect authentication data (set_id=kgl@kglsolucoes.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FoTI89xDErKxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BnMJ8txDvKWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.34
country_id: 2750405
description:
2025-11-18 08:41:34 dovecot_login authenticator failed for ([45.148.10.34]) [45.148.10.34]:61726: 535 Incorrect authentication data (set_id=distribution)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 08:41:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<wCji8txDnO2UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 08:41:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<URT38txDVKOl0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 08:43:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<kzQx99xD0r/Bl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 08:43:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<Uuc/99xDhu0I2Cjk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.37
country_id: 2750405
description:
2025-11-18 08:42:18 dovecot_login authenticator failed for ([45.148.10.37]) [45.148.10.37]:59135: 535 Incorrect authentication data (set_id=scanuser)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.66.120.237
country_id: 6252001
description:
2025-11-18 08:42:27 dovecot_login authenticator failed for ([209.66.120.237]) [209.66.120.237]:59022: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 08:42:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@oabsjp.org.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<a5sx9dxDmMGkXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-18 08:42:33 dovecot_plain authenticator failed for (provellims) [12.150.243.22]:16204: 535 Incorrect authentication data (set_id=design.user.ceo@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.206
country_id: 1269750
description:
2025-11-18 08:42:52 dovecot_login authenticator failed for ([125.21.145.49]) [182.95.52.206]:34274: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.36
country_id: 2750405
description:
2025-11-18 08:42:09 dovecot_login authenticator failed for ([45.148.10.36]) [45.148.10.36]:63503: 535 Incorrect authentication data (set_id=mailing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.35
country_id: 2750405
description:
2025-11-18 08:42:14 dovecot_login authenticator failed for ([45.148.10.35]) [45.148.10.35]:51237: 535 Incorrect authentication data (set_id=kitchen)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 08:42:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<EPlj9NxDBM6B4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.110.36.127
country_id: 3508796
description:
2025-11-18 08:42:33 dovecot_login authenticator failed for ([190.110.36.120]) [190.110.36.127]:50837: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<CFuZ9dxDAr2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.78.247
country_id: 2017370
description:
2025-11-18 08:43:21 dovecot_login authenticator failed for 89-179-78-247.broadband.corbina.ru [89.179.78.247]:54220: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 08:43:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<QeAT+dxDcOkI1et7>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:43:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KEo0+dxDntyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 08:43:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<rN2K+dxDlL9ns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.120
country_id: 2750405
description:
2025-11-18 08:43:52 dovecot_login authenticator failed for ([45.148.10.120]) [45.148.10.120]:62405: 535 Incorrect authentication data (set_id=dovecot)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 08:43:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<iKOi+NxDVLQkMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.206.93.107
country_id: 3017382
description:
2025-11-18 08:43:38 dovecot_login authenticator failed for 107.93.206.77.rev.sfr.net [77.206.93.107]:40256: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.122
country_id: 2750405
description:
2025-11-18 08:43:52 dovecot_login authenticator failed for ([45.148.10.122]) [45.148.10.122]:61333: 535 Incorrect authentication data (set_id=iris)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1Ya7/NxDdomxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.97
country_id: 2750405
description:
2025-11-18 08:44:51 dovecot_login authenticator failed for ([45.148.10.97]) [45.148.10.97]:50608: 535 Incorrect authentication data (set_id=wangkun)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.118
country_id: 2750405
description:
2025-11-18 08:45:06 dovecot_login authenticator failed for ([45.148.10.118]) [45.148.10.118]:53617: 535 Incorrect authentication data (set_id=advokat)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.64
country_id: 2750405
description:
2025-11-18 08:44:07 dovecot_login authenticator failed for ([45.148.10.64]) [45.148.10.64]:54518: 535 Incorrect authentication data (set_id=nicole)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.124
country_id: 2750405
description:
2025-11-18 08:44:10 dovecot_login authenticator failed for ([45.148.10.124]) [45.148.10.124]:63232: 535 Incorrect authentication data (set_id=lucy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 08:44:09 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:56315: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 08:44:26 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:56783: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.98
country_id: 2750405
description:
2025-11-18 08:44:50 dovecot_login authenticator failed for ([45.148.10.98]) [45.148.10.98]:50005: 535 Incorrect authentication data (set_id=alpha)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3HWE/txD1pKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.119
country_id: 2750405
description:
2025-11-18 08:45:07 dovecot_login authenticator failed for ([45.148.10.119]) [45.148.10.119]:56207: 535 Incorrect authentication data (set_id=zy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.87
country_id: 2750405
description:
2025-11-18 08:44:08 dovecot_login authenticator failed for ([45.148.10.87]) [45.148.10.87]:57210: 535 Incorrect authentication data (set_id=smtp)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.69
country_id: 2750405
description:
2025-11-18 08:45:19 dovecot_login authenticator failed for ([45.148.10.69]) [45.148.10.69]:56359: 535 Incorrect authentication data (set_id=cam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.44
country_id: 2750405
description:
2025-11-18 08:45:28 dovecot_login authenticator failed for ([45.148.10.44]) [45.148.10.44]:56637: 535 Incorrect authentication data (set_id=bill)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0UdVAN1DDKOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 08:45:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<JrlrAd1DLJ2kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 18 08:45:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<kP8a/9xDJM4zTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.46
country_id: 1814991
description:
2025-11-18 08:45:20 dovecot_login authenticator failed for ([111.26.62.45]) [111.26.62.46]:56202: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 08:45:19 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51875: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-18 08:45:35 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:33474: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.81
country_id: 2750405
description:
2025-11-18 08:46:21 dovecot_login authenticator failed for ([45.148.10.81]) [45.148.10.81]:60664: 535 Incorrect authentication data (set_id=consultant)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 08:46:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<N3v5BN1DTuHSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.166.105.105
country_id: 1814991
description:
2025-11-18 08:46:59 dovecot_login authenticator failed for ([223.166.105.105]) [223.166.105.105]:42450: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QVDpA91DuryxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.66.120.237
country_id: 6252001
description:
2025-11-18 08:46:40 dovecot_login authenticator failed for ([209.66.120.237]) [209.66.120.237]:60958: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 08:46:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<hpUxBN1DWJ2UcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.233.246
country_id: 1269750
description:
2025-11-18 08:46:59 dovecot_login authenticator failed for ([125.17.233.246]) [125.17.233.246]:33720: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.168.104.169
country_id: 1814991
description:
2025-11-18 08:47:03 dovecot_login authenticator failed for (pc169.zz.ha.cn) [61.168.104.169]:35250: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-11-18 08:47:09 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:42970: 535 Incorrect authentication data (set_id=postmaster@hosting.inovasite.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rS9/B91DZtmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.104.76.94
country_id: 1835841
description:
2025-11-18 08:47:39 dovecot_login authenticator failed for ([222.104.76.94]) [222.104.76.94]:54214: 535 Incorrect authentication data (set_id=lucas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.241.128.197
country_id: 6252001
description:
2025-11-18 08:47:57 dovecot_login authenticator failed for (syn-067-241-128-197.res.spectrum.com) [67.241.128.197]:51281: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.85
country_id: 1814991
description:
2025-11-18 08:47:09 dovecot_login authenticator failed for ([111.26.63.85]) [111.26.63.85]:55980: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.79.146.1
country_id: 2623032
description:
2025-11-18 08:47:22 dovecot_login authenticator failed for ([62.79.146.1]) [62.79.146.1]:40142: 535 Incorrect authentication data (set_id=lucas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.98
country_id: 798544
description:
2025-11-18 08:47:38 dovecot_login authenticator failed for (98.84.41.31.ip4.feromedia.eu) [31.41.84.98]:38739: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cC0+Cd1DQuaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-18 08:48:14 dovecot_login authenticator failed for ([125.19.175.94]) [122.184.120.98]:36924: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 08:48:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<cvjXCd1DNstSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 08:48:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<VthoC91DpK9SnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 08:48:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<2mE/Ct1DKtql0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-11-18 08:48:24 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:43896: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KbEIC91DdI+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 18 08:48:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<XmQ/C91D2nKnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.153.181.80
country_id: 1861060
description:
2025-11-18 08:48:46 dovecot_login authenticator failed for m106153181080.v4.enabler.ne.jp [106.153.181.80]:47438: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 138.122.133.28
country_id: 3469034
description:
2025-11-18 08:48:47 H=(localhost) [138.122.133.28]:41414 F=<hello@localhost> rejected RCPT <jhnYkLfF1kPSbFj@contabilidadefollador.com.br>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.110.36.127
country_id: 3508796
description:
2025-11-18 08:48:59 dovecot_login authenticator failed for ([190.110.36.120]) [190.110.36.127]:37072: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 138.122.133.28
country_id: 3469034
description:
2025-11-18 08:49:07 H=(localhost) [138.122.133.28]:41414 F=<hello@localhost> rejected RCPT <curriculo@contabilidadefollador.com.br>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.101.233.154
country_id: 1814991
description:
2025-11-18 08:49:22 dovecot_login authenticator failed for ([211.101.233.154]) [211.101.233.154]:58688: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.105.50
country_id: 1814991
description:
2025-11-18 08:49:26 dovecot_login authenticator failed for ([219.129.105.50]) [219.129.105.50]:50972: 535 Incorrect authentication data (set_id=faturamento)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 08:49:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<HSSKDt1DQtU+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 08:49:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@primiciapersianas.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<TuaXD91Dqtx2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.201.22.158
country_id: 290557
description:
2025-11-18 08:50:02 dovecot_login authenticator failed for ([94.201.22.158]) [94.201.22.158]:55377: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-11-18 08:49:09 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:42430: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-11-18 08:49:09 dovecot_login authenticator failed for (buenosnet.static.gvt.net.br) [187.115.144.103]:44355: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2025-11-18 08:49:16 dovecot_login authenticator failed for ([14.35.209.208]) [14.35.209.208]:43238: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2025-11-18 08:49:19 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:39104: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IAucDt1DrLKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.0.202
country_id: 2017370
description:
2025-11-18 08:50:44 dovecot_login authenticator failed for ([83.239.0.202]) [83.239.0.202]:56186: 535 Incorrect authentication data (set_id=cpanel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.8.143
country_id: 1668284
description:
2025-11-18 08:50:11 dovecot_login authenticator failed for 111-70-8-143.emome-ip.hinet.net [111.70.8.143]:37129: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
country_id: 6252001
description:
2025-11-18 08:50:18 dovecot_login authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:49466: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<f1w5Et1DotaxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rXECFN1DruixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 08:50:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<ESs/Ed1D/oxA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.34.2.179
country_id: 2017370
description:
2025-11-18 08:50:37 dovecot_login authenticator failed for ([77.34.2.179]) [77.34.2.179]:60807: 535 Incorrect authentication data (set_id=bruno)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 08:50:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<GfSNEt1DbLx3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 08:51:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<1WquFd1DVsOB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.106.177
country_id: 298795
description:
2025-11-18 08:51:50 dovecot_login authenticator failed for ([188.132.210.145]) [195.142.106.177]:12114: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.68
country_id: 3996063
description:
2025-11-18 08:52:06 dovecot_login authenticator failed for (201.173.216.68-clientes-izzi.mx) [201.173.216.68]:49465: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 08:51:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<460jFd1DRqgXXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hxDNFd1DToyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-11-18 08:51:33 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:53537: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.25.58.19
country_id: 1643084
description:
2025-11-18 08:51:52 dovecot_login authenticator failed for ([160.25.58.19]) [160.25.58.19]:50772: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 08:51:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<y9YPFd1DnMHSchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 08:51:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<DvuUFd1DZsiGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
country_id: 2658434
description:
2025-11-18 08:52:07 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:54491: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2025-11-18 08:52:25 dovecot_login authenticator failed for (49.207.15.25.actcorp.in) [49.207.15.25]:61906: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<x41dGd1DyraxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-18 08:52:40 dovecot_login authenticator failed for ([216.194.174.103]) [216.194.174.27]:41998: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:53:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</x33HN1DbNSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.143.88
country_id: 1819730
description:
2025-11-18 08:53:43 dovecot_login authenticator failed for (m121-202-143-88.smartone.com) [121.202.143.88]:54947: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 08:53:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<naWHHd1D0qMv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-11-18 08:53:55 dovecot_login authenticator failed for (cm-84.213.189.27.get.no) [84.213.189.27]:35134: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VFq2Ht1D+OaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.75
country_id: 1668284
description:
2025-11-18 08:54:10 dovecot_login authenticator failed for ([101.13.1.75]) [101.13.1.75]:34524: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.228.150
country_id: 1814991
description:
2025-11-18 08:54:22 dovecot_login authenticator failed for ([222.170.228.150]) [222.170.228.150]:54429: 535 Incorrect authentication data (set_id=lucas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+pGGIN1DbISxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-11-18 08:55:16 dovecot_plain authenticator failed for (frotornath) [65.20.191.12]:37535: 535 Incorrect authentication data (set_id=neemias.piler@arkson.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 18 08:55:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<ko9XI91DALsIiXsk>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JBMbJN1DTK6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 08:55:41 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51827: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 08:55:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<MnuKJN1D2NeElIx5>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 200.66.119.172
country_id: 3469034
description:
[2025-11-18 08:55:50 -0300] info [webmaild] 200.66.119.172 - sat.integracao@kglsolucoes.com "GET /cpsess7848880021/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 08:57:05 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52380: 535 Incorrect authentication data (set_id=conferencia2019@profetizandoasmulheres.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1gOoJ91DEMmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 08:56:35 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:53066: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.253.86
country_id: 1269750
description:
2025-11-18 08:56:38 dovecot_login authenticator failed for ([128.185.224.109]) [125.20.253.86]:51206: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.21.155.132
country_id: 3469034
description:
[2025-11-18 08:56:41 -0300] info [webmaild] 201.21.155.132 - josiane@schneidersglass.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User josiane@schneidersglass.com.br has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2025-11-18 08:57:03 dovecot_login authenticator failed for 94-255-255-26.cust.bredband2.com [94.255.255.26]:52516: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bpZ5Kd1DONaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 08:57:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<ZUHGKd1DEIal0iHB>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zDA4K91DPN+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.96.36.174
country_id: 1814991
description:
2025-11-18 08:57:49 dovecot_login authenticator failed for ([36.96.36.174]) [36.96.36.174]:64582: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.245.38
country_id: 1269750
description:
2025-11-18 08:57:48 dovecot_login authenticator failed for ([152.52.245.38]) [152.52.245.38]:55626: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
country_id: 1835841
description:
2025-11-18 08:58:02 dovecot_login authenticator failed for ([121.170.218.142]) [121.170.218.142]:46390: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.223.123
country_id: 3469034
description:
2025-11-18 08:58:03 dovecot_login authenticator failed for (clinicahumanas.sdr.gvt.net.br) [177.135.223.123]:39242: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 08:57:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<c9fOKd1DyJUrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-11-18 08:57:30 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:52296: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2025-11-18 08:57:51 dovecot_login authenticator failed for ([83.239.84.130]) [83.239.84.130]:35769: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-18 08:58:02 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:52134: 535 Incorrect authentication data (set_id=atualizacoes1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<jOvVLt1DAIyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2025-11-18 08:58:37 dovecot_login authenticator failed for (abts-mum-static-195.99.170.122.airtelbroadband.in) [122.170.99.195]:60462: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 08:58:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pousadarincaoalegre.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<SHU5L91DTs1zR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.82.9.238
country_id: 6252001
description:
2025-11-18 08:58:50 dovecot_login authenticator failed for (1075fm.com.br) [206.82.9.238]:62371: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.0.144
country_id: 2077456
description:
2025-11-18 08:58:08 dovecot_login authenticator failed for 121-44-0-144.tpgi.com.au [121.44.0.144]:51602: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.84.107.55
country_id: 2661886
description:
Nov 18 08:58:07 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<bianca@globalmedica.com.br>, method=PLAIN, rip=45.84.107.55, lip=200.150.196.245, TLS: Connection closed, session=<guprLN1Ds3ktVGs3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-11-18 08:58:29 dovecot_login authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:38164: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.185.94
country_id: 1269750
description:
2025-11-18 08:58:19 dovecot_login authenticator failed for ([125.18.28.146]) [125.17.185.94]:51363: 535 Incorrect authentication data (set_id=novamanha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-11-18 08:58:22 dovecot_login authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:47136: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 08:59:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@alcantaraemonteiro.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<3DFZMN1DdM12wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 18 09:00:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<BKNLNN1D5OO317Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 08:59:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<OavSMN1DxNKB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-11-18 08:59:11 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:44003: 535 Incorrect authentication data (set_id=marcos@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 08:59:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<qYnFM91DJLmvfiX3>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 201.21.155.132
country_id: 3469034
description:
[2025-11-18 08:59:35 -0300] info [webmaild] 201.21.155.132 - josiane@schneidersglass.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: User josiane@schneidersglass.com.br has their account suspended. Login blocked.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.254
country_id: 1814991
description:
2025-11-18 08:59:46 dovecot_login authenticator failed for ([111.26.95.253]) [111.26.95.254]:35322: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 08:59:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<Mi7WM91DcLRA44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HmYzNN1Dzq+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-11-18 08:59:28 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:50735: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
country_id: 6252001
description:
2025-11-18 08:59:32 dovecot_login authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:59362: 535 Incorrect authentication data (set_id=marcos)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 08:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6xllMt1DIqaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 09:00:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<PSn7NN1DkImB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 09:00:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<qz64Nd1DltNCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 09:00:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<jOMnNt1DPORns7yS>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 177.4.64.247
country_id: 3469034
description:
[2025-11-18 09:00:18 -0300] info [webmaild] 177.4.64.247 - xavier@projetocircense.com.br "GET /cpsess9988883684/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 09:00:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<Lr0+Nd1DBrZSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.128.7
country_id: 1814991
description:
2025-11-18 09:00:31 dovecot_login authenticator failed for ([58.17.128.7]) [58.17.128.7]:57501: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NF/1Nd1D2MKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.15
country_id: 2186224
description:
2025-11-18 09:00:45 dovecot_login authenticator failed for ([121.73.162.15]) [121.73.162.15]:43076: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.212.198.226
country_id: 1814991
description:
2025-11-18 09:01:12 dovecot_login authenticator failed for ([27.212.198.226]) [27.212.198.226]:52639: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 09:01:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<DZ03ON1DTqMtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 09:01:25 dovecot_login authenticator failed for (User) [177.74.174.120]:65499: 535 Incorrect authentication data (set_id=camila@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 09:01:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<+f9mOd1DN+l3xBIC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HPGGOd1DLNexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.108.218
country_id: 2017370
description:
2025-11-18 09:01:42 dovecot_login authenticator failed for ([83.239.108.218]) [83.239.108.218]:56079: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 09:01:56 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:62845: 535 Incorrect authentication data (set_id=sales@jacgeneralcleaning.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<jnjjPt1DVJuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 09:02:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<07LHO91DDIp9gnHM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 09:02:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<UNkFPN1D3t1n9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.155.199.176
country_id: 3469034
description:
Nov 18 09:02:33 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=<RcApPd1DpOaxm8ew>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+X4iPd1DpoexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 09:03:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<J9etPt1DRu2UcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.246.31.172
country_id: 1814991
description:
2025-11-18 09:03:09 dovecot_login authenticator failed for ([116.246.31.172]) [116.246.31.172]:33432: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-18 09:03:10 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:39310: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 09:03:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<Wj1CP91D0pFw2eny>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.94.168.28
country_id: 3469034
description:
[2025-11-18 09:03:37 -0300] info [webmaild] 138.94.168.28 - hipercestafrota@hipercesta.com.br "GET /cpsess1583503987/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 09:03:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<QRpUQd1D4vBxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
country_id: 1814991
description:
2025-11-18 09:04:06 dovecot_login authenticator failed for ([113.219.177.95]) [113.219.177.95]:44908: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-11-18 09:03:21 dovecot_login authenticator failed for (buenosnet.static.gvt.net.br) [187.115.144.103]:33664: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<X5qxQN1DnquxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.131.216.81
country_id: 660013
description:
2025-11-18 09:03:36 dovecot_login authenticator failed for dynamic-216-81.keskikaista.fi [185.131.216.81]:51612: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 09:04:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<rqrHQt1DjuM7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-11-18 09:04:38 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:38542: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.135.168.148
country_id: 1814991
description:
2025-11-18 09:04:59 dovecot_login authenticator failed for ([219.135.168.148]) [219.135.168.148]:47105: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<iphFRN1DAsixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-18 09:04:37 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:52155: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-18 09:04:40 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:41617: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
country_id: 1269750
description:
2025-11-18 09:04:50 dovecot_login authenticator failed for ([45.250.249.12]) [45.250.249.12]:45480: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2025-11-18 09:05:03 dovecot_login authenticator failed for ([119.6.108.13]) [119.6.108.13]:50685: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.94.168.28
country_id: 3469034
description:
[2025-11-18 09:04:15 -0300] info [webmaild] 138.94.168.28 - hipercestafrota@hipercesta.com.br "GET /cpsess9926606530/3rdparty/roundcube/?_task=mail&_action=search&_interval=&_q=1316810&_headers=text&_layout=widescreen&_filter=ALL&_scope=base&_mbox=INBOX&_remote=1&_unlock=loading1763467454867&_=1763467284904 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.16.71.254
country_id: 6252001
description:
2025-11-18 09:04:21 dovecot_login authenticator failed for ([209.16.71.254]) [209.16.71.254]:63446: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.134.56
country_id: 3374766
description:
2025-11-18 09:04:22 dovecot_login authenticator failed for ([197.255.134.56]) [197.255.134.56]:34478: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<y3nTR91DZOSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 09:05:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<aBEUSN1DTKIv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.243.109.221
country_id: 2750405
description:
2025-11-18 09:05:44 dovecot_plain authenticator failed for ([151.243.109.221]) [151.243.109.221]:52290: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.39
country_id: 1814991
description:
2025-11-18 09:06:06 dovecot_login authenticator failed for ([111.26.62.38]) [111.26.62.39]:59586: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.247.80.227
country_id: 1269750
description:
2025-11-18 09:05:38 dovecot_login authenticator failed for ([47.247.80.227]) [47.247.80.227]:43200: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 09:05:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fernandotonet.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<zqyBSN1DFLh2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.113.208.46
country_id: 6252001
description:
2025-11-18 09:05:51 dovecot_login authenticator failed for 46.208.113.136.bc.googleusercontent.com [136.113.208.46]:43634: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2025-11-18 09:05:51 dovecot_login authenticator failed for ([219.248.4.146]) [219.248.4.146]:39260: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BKGdSd1DfIWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.75.225.206
country_id: 1814991
description:
2025-11-18 09:07:06 dovecot_login authenticator failed for ([222.75.225.206]) [222.75.225.206]:44069: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-11-18 09:06:08 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:57082: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.224.62
country_id: 1269750
description:
2025-11-18 09:06:11 dovecot_login authenticator failed for ([182.95.224.62]) [182.95.224.62]:41040: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.3.246
country_id: 3017382
description:
2025-11-18 09:06:20 dovecot_login authenticator failed for ([188.231.3.246]) [188.231.3.246]:52329: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Bb5sS91DppCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 09:06:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<fS9uS91DSp5ns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.42
country_id: 1814991
description:
2025-11-18 09:06:36 dovecot_login authenticator failed for ([111.26.62.42]) [111.26.62.42]:44514: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.93.170
country_id: 1269750
description:
2025-11-18 09:06:21 dovecot_login authenticator failed for ([182.78.93.170]) [182.78.93.170]:41018: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 09:06:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<JdW/St1DlPxxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.229.254.207
country_id: 2017370
description:
2025-11-18 09:06:29 dovecot_login authenticator failed for ([87.229.254.207]) [87.229.254.207]:49824: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2025-11-18 09:06:44 dovecot_login authenticator failed for ([106.247.22.181]) [106.247.22.181]:57978: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-11-18 09:06:44 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (boebiumble) [68.46.148.180]:55070: 535 Incorrect authentication data (set_id=marcoaurelio.vendas@maringatruckparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 09:07:39 dovecot_login authenticator failed for (User) [177.74.174.120]:51872: 535 Incorrect authentication data (set_id=camila@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
country_id: 1814991
description:
2025-11-18 09:07:45 dovecot_login authenticator failed for ([27.223.98.117]) [27.223.98.117]:49474: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.126
country_id: 1814991
description:
2025-11-18 09:07:21 dovecot_login authenticator failed for ([111.26.95.126]) [111.26.95.126]:58068: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 09:07:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<X1LkTt1DotJ9gnHM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Ezz9Tt1DaKyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-11-18 09:08:23 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:57146: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.166.13
country_id: 2017370
description:
2025-11-18 09:08:35 dovecot_login authenticator failed for (92x255x166x13.static-business.tmn.ertelecom.ru) [92.255.166.13]:40380: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.176.195
country_id: 798544
description:
2025-11-18 09:08:23 dovecot_login authenticator failed for 5.185.176.195.ipv4.public.orange.pl [5.185.176.195]:36046: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-11-18 09:08:31 dovecot_login authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:56754: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.33.96.3
country_id: 1835841
description:
2025-11-18 09:08:34 dovecot_login authenticator failed for ([14.33.96.3]) [14.33.96.3]:48641: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2025-11-18 09:08:46 dovecot_login authenticator failed for ([37.210.246.54]) [37.210.246.54]:41682: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 09:08:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<x0HFU91DtrkkMrBu>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4rxjVN1D3tmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-18 09:08:59 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:52154: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
country_id: 1814991
description:
2025-11-18 09:08:09 dovecot_login authenticator failed for ([27.223.98.117]) [27.223.98.117]:43781: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 09:08:13 dovecot_login authenticator failed for (User) [177.74.174.120]:51872: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2025-11-18 09:08:29 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:60635: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zN6NUt1DSMaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 09:08:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<XvqeUt1D1LNAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.206
country_id: 1861060
description:
2025-11-18 09:08:43 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [154.47.20.206]:21653: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 09:09:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<uarUVN1DDJNvAEul>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:09:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<eTgvVt1DDOmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 09:09:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=</kUiVt1Dxuxrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 09:10:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<fMzRV91DVthns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.167
country_id: 2186224
description:
2025-11-18 09:10:04 dovecot_login authenticator failed for ([121.73.169.167]) [121.73.169.167]:40090: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 09:09:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<uOe3VN1D6OctPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 09:09:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<iLT8Vd1DRsGP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 09:10:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<AIteWN1DfqdCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 09:10:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<Qoy2WN1D3Opn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 09:10:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<bcJVWd1D8raGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-11-18 09:10:54 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:58404: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 18 09:10:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<hLlYWN1D9uEvT1jH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 09:10:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<OcoHWd1DNNMXXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rrW2Wd1DisSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.89
country_id: 1814991
description:
2025-11-18 09:10:52 dovecot_login authenticator failed for ([111.26.63.88]) [111.26.63.89]:49638: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2025-11-18 09:10:59 dovecot_login authenticator failed for (aes-static-097.188.22.125.airtel.in) [122.184.118.126]:42552: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 09:11:31 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64981: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JBpUXd1DfuGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 09:11:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<zT2xXt1Dkrsv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.80.155
country_id: 1819730
description:
2025-11-18 09:11:10 dovecot_login authenticator failed for (182.239.80.155.hk.chinamobile.com) [182.239.80.155]:55330: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.167.203.56
country_id: 1814991
description:
2025-11-18 09:11:20 dovecot_login authenticator failed for ([223.167.203.56]) [223.167.203.56]:15833: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 09:11:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<5rVAXd1DLt5o7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
country_id: 1835841
description:
2025-11-18 09:11:44 dovecot_login authenticator failed for ([121.170.218.142]) [121.170.218.142]:56734: 535 Incorrect authentication data (set_id=recepcao)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-11-18 09:12:00 dovecot_login authenticator failed for (pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:53202: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:12:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hj0gX91DaIWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 09:12:06 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52367: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
country_id: 1814991
description:
2025-11-18 09:11:19 dovecot_login authenticator failed for ([58.57.154.146]) [58.57.154.146]:18716: 535 Incorrect authentication data (set_id=escritura1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dD3mYN1DQJWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.14.34
country_id: 1668284
description:
2025-11-18 09:12:43 dovecot_login authenticator failed for (58-115-14-34.twt1.com.tw) [58.115.14.34]:45860: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.122.98.135
country_id: 1835841
description:
2025-11-18 09:12:43 dovecot_login authenticator failed for ([222.122.98.135]) [222.122.98.135]:54417: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.92.36
country_id: 1814991
description:
2025-11-18 09:13:05 dovecot_login authenticator failed for ([36.135.92.35]) [36.135.92.36]:37726: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.193.128.123
country_id: 1269750
description:
2025-11-18 09:12:17 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [116.193.128.123]:59306: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.122.79
country_id: 1814991
description:
2025-11-18 09:12:26 dovecot_login authenticator failed for ([182.135.122.79]) [182.135.122.79]:58328: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-11-18 09:13:12 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:46348: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.63.13
country_id: 453733
description:
2025-11-18 09:13:14 dovecot_login authenticator failed for 13-63-166-83.dyn.estpak.ee [83.166.63.13]:54566: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<80p8ZN1DpLmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.65.99
country_id: 3144096
description:
2025-11-18 09:14:03 dovecot_login authenticator failed for (cm-178.232.65.99.get.no) [178.232.65.99]:59043: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-11-18 09:13:25 dovecot_plain authenticator failed for (bitainid) [65.20.205.197]:48495: 535 Incorrect authentication data (set_id=amarildo@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 09:13:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@brinquelocacoes.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<xfcVZd1DfspzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.195.117.220
country_id: 3017382
description:
2025-11-18 09:13:48 dovecot_login authenticator failed for vps-f9a28e39.vps.ovh.net [51.195.117.220]:20097: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 09:13:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<fnorZd1DRJErmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.46.148.180
country_id: 6252001
description:
2025-11-18 09:14:03 dovecot_plain authenticator failed for c-68-46-148-180.hsd1.mi.comcast.net (pseyfy) [68.46.148.180]:48806: 535 Incorrect authentication data (set_id=jomma@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.145.123
country_id: 1814991
description:
2025-11-18 09:14:04 dovecot_login authenticator failed for ([61.191.145.123]) [61.191.145.123]:48769: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.231.6
country_id: 1269750
description:
2025-11-18 09:14:29 dovecot_login authenticator failed for ([128.185.231.6]) [128.185.231.6]:33572: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.94.168.28
country_id: 3469034
description:
[2025-11-18 09:14:45 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 09:14:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<zFBead1DDr5o7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DGDTad1DYuuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 18 09:14:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<Hul+Zt1DlK0kMrGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 09:14:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<i0vjZt1Dv+V3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.66.142.41
country_id: 3582678
description:
2025-11-18 09:14:27 dovecot_login authenticator failed for (freshtools.to) [185.66.142.41]:52244: 535 Incorrect authentication data (set_id=araca@adportobelo.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<plYHaN1Dqt2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 18 09:14:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<Pxdgad1Df5Nbejg7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-11-18 09:15:08 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:54008: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.36
country_id: 2245662
description:
2025-11-18 09:14:15 dovecot_login authenticator failed for ([213.154.80.21]) [213.154.80.36]:58073: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.204.134.124
country_id: 6252001
description:
2025-11-18 09:14:32 dovecot_plain authenticator failed for c-98-204-134-124.hsd1.md.comcast.net (artek) [98.204.134.124]:53072: 535 Incorrect authentication data (set_id=andre.parisenti@calcautomacao.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 09:14:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<2mBLaN1DSK5vAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-11-18 09:14:42 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:45772: 535 Incorrect authentication data (set_id=cpanel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2025-11-18 09:14:50 dovecot_login authenticator failed for ([65.20.250.180]) [65.20.250.180]:47073: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 09:15:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<fsz3at1DHqInaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.111.249.76
country_id: 2017370
description:
2025-11-18 09:15:49 dovecot_login authenticator failed for pppoe-78-111-249-76.dynamic.tvingo.ru [78.111.249.76]:36038: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.151.45.136
country_id: 1814991
description:
2025-11-18 09:15:15 dovecot_login authenticator failed for ([182.151.45.136]) [182.151.45.136]:49830: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.93.170
country_id: 1269750
description:
2025-11-18 09:15:31 dovecot_login authenticator failed for ([182.78.93.170]) [182.78.93.170]:35708: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-18 09:15:43 dovecot_login authenticator failed for ([119.160.166.237]) [119.160.166.237]:60410: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 09:15:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<IZ+vbN1DzttSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2025-11-18 09:15:50 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:33276: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 09:15:56 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51937: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-11-18 09:16:04 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:58199: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.158.205.225
country_id: 1861060
description:
2025-11-18 09:15:19 dovecot_login authenticator failed for kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:60591: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.81.209.76
country_id: 2017370
description:
2025-11-18 09:15:23 dovecot_login authenticator failed for ([78.81.209.76]) [78.81.209.76]:45468: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<jwiia91DSpCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.133.98
country_id: 1814991
description:
2025-11-18 09:15:37 dovecot_login authenticator failed for ([221.224.133.98]) [221.224.133.98]:56944: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 09:15:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<J5p0a91DFvavfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 09:15:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<gvpya91DcK1n9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 09:16:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<iZjvbt1DqtNCYSpH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<scMtb91D4K6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
country_id: 2017370
description:
2025-11-18 09:16:36 dovecot_login authenticator failed for ([178.178.222.47]) [178.178.222.47]:43998: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 09:16:47 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51370: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.95
country_id: 1814991
description:
2025-11-18 09:16:08 dovecot_login authenticator failed for ([36.135.62.94]) [36.135.62.95]:51490: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 09:16:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<yIjlbd1DysKElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 09:17:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<yhs3cd1Dmtt3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2025-11-18 09:17:22 dovecot_login authenticator failed for 89-67-38-27.dynamic.play.pl [89.67.38.27]:55468: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3sbKct1DSs2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 09:17:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<nD83c91DvMhrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 09:17:44 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51508: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mEmHdN1DbNyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 09:17:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<OmQOc91DONwnaoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 09:17:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<hoGqc91DXujBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-11-18 09:17:57 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:55203: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.221.107.252
country_id: 3469034
description:
2025-11-18 09:17:26 dovecot_plain authenticator failed for (CBSALA-FP6e) [177.221.107.252]:31321: 535 Incorrect authentication data (set_id=opec@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.84.78.69
country_id: 630336
description:
2025-11-18 09:17:52 dovecot_login authenticator failed for ([93.84.78.69]) [93.84.78.69]:48774: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.203.179.228
country_id: 1814991
description:
2025-11-18 09:17:40 dovecot_login authenticator failed for ([218.203.179.228]) [218.203.179.228]:35346: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2025-11-18 09:17:47 dovecot_login authenticator failed for ([45.82.109.136]) [45.82.109.136]:53536: 535 Incorrect authentication data (set_id=sandromiguel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 09:18:11 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51992: 535 Incorrect authentication data (set_id=nfe2@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-11-18 09:18:14 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:47320: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 09:18:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<xSBbdd1DtuZAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-11-18 09:18:28 dovecot_login authenticator failed for ([182.79.95.139]) [152.52.246.178]:59434: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<V65Wdt1DaIKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 09:18:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<D1U6dt1DpsVA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-18 09:18:47 dovecot_login authenticator failed for ([61.246.66.225]) [182.95.174.18]:58170: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 09:18:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<zFNtd91D4OYtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-18 09:18:57 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:47388: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-11-18 09:19:52 dovecot_login authenticator failed for ([189.108.156.41]) [187.8.64.94]:52732: 535 Incorrect authentication data (set_id=misterthomas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:19:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PYnyed1Drp6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 09:19:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@f5assessoria.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<dbI7et1DPq12wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 09:19:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<JanYet1DzJ+kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 09:19:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<DB0Ee91DLsotPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-11-18 09:19:32 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:53230: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.137.151.93
country_id: 1814991
description:
2025-11-18 09:19:36 dovecot_login authenticator failed for ([180.137.151.93]) [180.137.151.93]:40666: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 09:19:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@highqualityautoparts.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<Z8W+et1Dsto+PIOL>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<E5GBfd1DGL6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.59.34.5
country_id: 1814991
description:
2025-11-18 09:20:33 dovecot_login authenticator failed for ([113.59.34.8]) [113.59.34.5]:40572: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.203.70.75
country_id: 3374766
description:
2025-11-18 09:20:46 dovecot_login authenticator failed for ([154.203.70.75]) [154.203.70.75]:33896: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rBpCf91DVs+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.61.146
country_id: 1814991
description:
2025-11-18 09:21:06 dovecot_login authenticator failed for ([120.198.61.146]) [120.198.61.146]:59188: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.83
country_id: 1814991
description:
2025-11-18 09:20:17 dovecot_login authenticator failed for ([36.135.62.82]) [36.135.62.83]:40822: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 09:20:20 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52183: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 09:20:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<YMdXfd1DuqiP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 18 09:20:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@prolip.com.br>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<l+n0e91D9ryiAOAm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JBkOgd1DuOGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.15.194.58
country_id: 1814991
description:
2025-11-18 09:22:01 dovecot_login authenticator failed for ([60.15.194.58]) [60.15.194.58]:47869: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2025-11-18 09:21:20 dovecot_login authenticator failed for ([102.214.44.117]) [102.214.44.117]:44556: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 09:22:24 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:49698: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2025-11-18 09:22:31 dovecot_login authenticator failed for ([101.13.6.86]) [101.13.6.86]:56104: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 18 09:22:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<bO+1hN1DerZ57bKF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 09:22:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@toromartelinho.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<NUXkhN1DzpVzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.32.68.66
country_id: 1835841
description:
2025-11-18 09:22:50 dovecot_login authenticator failed for ([61.32.68.66]) [61.32.68.66]:27244: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.92.66.188
country_id: 6251999
description:
2025-11-18 09:22:20 dovecot_login authenticator failed for ([147.92.66.188]) [147.92.66.188]:43685: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 09:22:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<VVwkhN1D5N4O4dKR>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:22:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<LKCshN1DXJOxV3kv>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-18 09:23:05 H=(195.3.134.135) [179.0.178.53]:54197 F=<erictremblaysi@hotmail.com> rejected RCPT <fahecon@transol.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:54197 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 09:23:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=</HB9ht1DCqII2Cjk>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3XD+id1DnL6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 09:23:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<7ZLjht1D+oKUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 09:23:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<8ETaht1DIK2B4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.28.253.144
country_id: 690791
description:
2025-11-18 09:23:17 dovecot_login authenticator failed for (undefined.sevstar.net) [31.28.253.144]:60404: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5/Q8iN1DYKyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.149.120.254
country_id: 6252001
description:
2025-11-18 09:23:35 dovecot_login authenticator failed for ([24.149.120.254]) [24.149.120.254]:36810: 535 Incorrect authentication data (set_id=escritura1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.130
country_id: 1269750
description:
2025-11-18 09:23:41 dovecot_login authenticator failed for ([182.95.176.130]) [182.95.176.130]:48962: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.92.36
country_id: 1814991
description:
2025-11-18 09:24:49 dovecot_login authenticator failed for ([36.135.92.36]) [36.135.92.36]:54158: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.195.211.98
country_id: 6252001
description:
2025-11-18 09:24:54 dovecot_plain authenticator failed for c-73-195-211-98.hsd1.nj.comcast.net (brozen) [73.195.211.98]:58478: 535 Incorrect authentication data (set_id=design.user.legal@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 18 09:24:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<74iljN1DsoOiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.199.146.204
country_id: 192950
description:
2025-11-18 09:24:08 dovecot_login authenticator failed for (ADMIN) [217.199.146.204]:56665: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-11-18 09:24:08 dovecot_login authenticator failed for ([61.72.59.106]) [61.72.59.106]:40934: 535 Incorrect authentication data (set_id=cpanel)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 09:24:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<lL3oit1DXIJns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 09:24:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@f5assessoria.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<HMkyjN1Dzp2kXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.29.179.121
country_id: 1814991
description:
2025-11-18 09:24:48 dovecot_login authenticator failed for ([14.29.179.121]) [14.29.179.121]:45136: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 09:24:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<LpaHjN1DmpWl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.25.183
country_id: 298795
description:
2025-11-18 09:24:27 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:58252: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:24:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<J4LUi91DGsuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 18 09:24:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<7VIOjN1DMM4zTY0d>


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.140.71.81
country_id: 2802361
description:
Nov 18 09:24:48 hosting pure-ftpd: (?@34.140.71.81) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.207.250.28
country_id: 130758
description:
2025-11-18 09:25:00 dovecot_plain authenticator failed for (premi) [213.207.250.28]:57974: 535 Incorrect authentication data (set_id=design.user.legal@inovasite.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.94.168.28
country_id: 3469034
description:
[2025-11-18 09:25:50 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 09:26:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<ezMCkd1DxsQI1et7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2025-11-18 09:25:28 dovecot_login authenticator failed for ([31.148.174.234]) [31.148.174.234]:53084: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YL5hj91DQOqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 09:25:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<i8kJkN1DNoSkXF7M>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<svjDlN1DWqexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 09:26:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<OdZ7kd1DnpLBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-18 09:26:18 dovecot_login authenticator failed for (gatecidos.static.gvt.net.br) [179.185.29.233]:49604: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<X1f0kt1D6pqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
country_id: 1835841
description:
2025-11-18 09:26:36 dovecot_login authenticator failed for ([58.228.105.192]) [58.228.105.192]:57902: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.205
country_id: 2750405
description:
2025-11-18 09:26:43 dovecot_login authenticator failed for (ADMIN) [84.54.33.205]:64999: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DZKHlt1DFLKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 09:27:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@primiciapersianas.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<p3Kxl91Dap2kXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.14.192.20
country_id: 1835841
description:
2025-11-18 09:27:57 dovecot_login authenticator failed for ([110.14.192.20]) [110.14.192.20]:53698: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.66.134
country_id: 1880251
description:
2025-11-18 09:27:10 dovecot_login authenticator failed for (134.66.129.180.unknown.m1.com.sg) [180.129.66.134]:50501: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-11-18 09:27:29 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:39207: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 09:27:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<UFtSlt1DALpSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-18 09:28:08 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:34417: 535 Incorrect authentication data (set_id=colonialrodas@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
country_id: 1880251
description:
2025-11-18 09:28:34 dovecot_login authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:59326: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.90.176
country_id: 690791
description:
2025-11-18 09:28:10 dovecot_plain authenticator failed for (spiato) [178.16.90.176]:43425: 535 Incorrect authentication data (set_id=design@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2025-11-18 09:28:19 dovecot_login authenticator failed for ([108.143.69.79]) [108.143.69.79]:46786: 535 Incorrect authentication data (set_id=colonialrodas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 09:28:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<lHAcmd1DpsiUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2025-11-18 09:28:22 dovecot_login authenticator failed for ([83.239.84.130]) [83.239.84.130]:36712: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
country_id: 1814991
description:
2025-11-18 09:28:27 dovecot_login authenticator failed for ([117.175.160.58]) [117.175.160.58]:54038: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.110.36.127
country_id: 3508796
description:
2025-11-18 09:28:33 dovecot_login authenticator failed for ([190.110.36.120]) [190.110.36.127]:35031: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<X5QUmt1D0tKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.41.172
country_id: 390903
description:
2025-11-18 09:29:04 dovecot_login authenticator failed for (149-210-41-172.mobile.nym.cosmote.net) [149.210.41.172]:34612: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.243.8.74
country_id: 6252001
description:
2025-11-18 09:29:30 dovecot_login authenticator failed for ([162.243.8.74]) [162.243.8.74]:53214: 535 Incorrect authentication data (set_id=rsimoesdiretoria@hipercesta.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0Lusnd1DuISxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 09:29:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fernandotonet.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<utOXnt1DBuCkXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 09:29:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@oabsjp.org.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<q+Vynd1DkKZ2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
country_id: 2017370
description:
2025-11-18 09:29:42 dovecot_login authenticator failed for ([178.178.222.56]) [178.178.222.56]:60230: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
country_id: 1835841
description:
2025-11-18 09:29:45 dovecot_login authenticator failed for ([112.186.241.102]) [112.186.241.102]:36428: 535 Incorrect authentication data (set_id=rsimoesdiretoria)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 09:29:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<NM/Ont1DrMzSchJs>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Vtpyn91D2pKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 09:30:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<2iYgot1DfOzBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.225.19.144
country_id: 2661886
description:
2025-11-18 09:30:51 dovecot_plain authenticator failed for c-85-225-19-144.bbcust.telenor.se (untolan) [85.225.19.144]:50188: 535 Incorrect authentication data (set_id=design.user.finance@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2025-11-18 09:30:53 dovecot_login authenticator failed for ([221.209.48.203]) [221.209.48.203]:50396: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.95
country_id: 1814991
description:
2025-11-18 09:30:28 dovecot_login authenticator failed for ([27.24.141.95]) [27.24.141.95]:48074: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vrVHod1D8qaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.161.143
country_id: 2186224
description:
2025-11-18 09:30:37 dovecot_login authenticator failed for ([121.73.161.143]) [121.73.161.143]:40292: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.246.31.172
country_id: 1814991
description:
2025-11-18 09:30:49 dovecot_login authenticator failed for ([116.246.31.172]) [116.246.31.172]:39324: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 09:31:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<O3CMo91DzL0kMrBu>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9MrWpN1DeMWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 09:32:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<1//Cpt1DRuQXXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<blA1qt1DgoqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 09:33:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<SRI0qt1D2t1SnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-18 09:33:06 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:48650: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 09:32:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<q/Kbp91DWrdA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-11-18 09:32:40 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:46929: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
country_id: 1605651
description:
2025-11-18 09:33:03 dovecot_login authenticator failed for ([110.77.137.236]) [110.77.137.236]:47556: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2025-11-18 09:32:50 dovecot_login authenticator failed for ([183.104.220.84]) [183.104.220.84]:59094: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 09:32:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<pZvKp91DtrKGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-11-18 09:32:31 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:33134: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 09:32:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<U58oqN1DZcV3xBIC>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lZtsqN1DmumxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 09:33:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<5VkFrN1D5Nw+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Nov 18 09:33:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=<HvRyrN1D+L7BHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 09:33:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<LY/0rN1D7Jwv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-18 09:33:11 dovecot_plain authenticator failed for host-196-47-172-253.afnet.net (bremon) [196.47.172.253]:55143: 535 Incorrect authentication data (set_id=amarildo@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.79.112
country_id: 1814991
description:
2025-11-18 09:33:17 dovecot_login authenticator failed for ([111.26.79.111]) [111.26.79.112]:55016: 535 Incorrect authentication data (set_id=eleicoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-11-18 09:33:30 dovecot_login authenticator failed for (82-102-165-200.orange.net.il) [82.102.165.200]:38059: 535 Incorrect authentication data (set_id=eleicoes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MT8DrN1DUqKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-11-18 09:34:22 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:33030: 535 Incorrect authentication data (set_id=jornalismo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.61.244
country_id: 1814991
description:
2025-11-18 09:34:39 dovecot_login authenticator failed for ([111.26.61.244]) [111.26.61.244]:51310: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-11-18 09:35:01 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:40019: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.27
country_id: 6252001
description:
2025-11-18 09:35:06 dovecot_login authenticator failed for ([70.174.168.27]) [70.174.168.27]:53910: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-11-18 09:34:12 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:49712: 535 Incorrect authentication data (set_id=jornalismo@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 09:34:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<pT3hrt1Dmq3SchJs>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OHOSr91DfsKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 09:34:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<mw3cr91DRMOB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-11-18 09:34:50 dovecot_login authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:49802: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.194
country_id: 1269750
description:
2025-11-18 09:35:00 dovecot_login authenticator failed for ([152.52.234.46]) [182.95.176.194]:55616: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
country_id: 1814991
description:
2025-11-18 09:35:20 dovecot_login authenticator failed for ([117.175.160.58]) [117.175.160.58]:34288: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-11-18 09:35:22 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:34172: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.56.60.121
country_id: 298795
description:
2025-11-18 09:35:36 dovecot_login authenticator failed for ([31.56.60.121]) [31.56.60.121]:60422: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 09:35:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<5cYjst1DlKOElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.225.5
country_id: 1814991
description:
2025-11-18 09:35:22 dovecot_login authenticator failed for ([60.172.225.5]) [60.172.225.5]:55228: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ebQns91D6OmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2025-11-18 09:35:59 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:49967: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BlzntN1DjIqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-11-18 09:36:20 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:53844: 535 Incorrect authentication data (set_id=cpanel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-18 09:36:23 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:51578: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:36:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<s/q+tt1DrJ+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2025-11-18 09:36:36 dovecot_login authenticator failed for ([189.113.185.14]) [189.113.185.14]:40350: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.6.99
country_id: 1814991
description:
2025-11-18 09:36:58 dovecot_login authenticator failed for ([61.169.6.99]) [61.169.6.99]:40768: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.144.131.25
country_id: 1814991
description:
Nov 18 09:36:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=122.144.131.25, lip=200.150.196.245, session=<x9V5td1DOK96kIMZ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 09:37:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<r1oSu91DUqlw2eny>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-11-18 09:37:56 dovecot_login authenticator failed for ([125.19.165.242]) [125.19.188.98]:57702: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 09:37:28 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:62915: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<oy1Put1DUL6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.89.87
country_id: 690791
description:
2025-11-18 09:37:38 dovecot_plain authenticator failed for (metrus) [178.16.89.87]:32870: 535 Incorrect authentication data (set_id=marcoaurelio.vendas@maringatruckparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-11-18 09:37:38 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:52104: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.114.251
country_id: 6252001
description:
2025-11-18 09:37:41 dovecot_plain authenticator failed for c-98-192-114-251.hsd1.ga.comcast.net (psess) [98.192.114.251]:39884: 535 Incorrect authentication data (set_id=marcoaurelio.vendas@maringatruckparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
country_id: 2017370
description:
2025-11-18 09:38:11 dovecot_login authenticator failed for ([92.255.190.69]) [92.255.190.69]:47628: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KPbYvd1DxNqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 09:38:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<XjYnvt1DAt0rmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.35.70.26
country_id: 248816
description:
2025-11-18 09:38:56 dovecot_login authenticator failed for (212.35.70.26.ua.batelco.jo) [212.35.70.26]:34543: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-11-18 09:38:59 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:51216: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.111.2
country_id: 1562822
description:
2025-11-18 09:38:26 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:36334: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-18 09:38:28 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:53720: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-18 09:38:27 dovecot_login authenticator failed for ([179.185.29.233]) [179.185.29.233]:56288: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.235.243
country_id: 1814991
description:
2025-11-18 09:38:46 dovecot_login authenticator failed for ([117.175.235.243]) [117.175.235.243]:49248: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 191.177.160.64
country_id: 3469034
description:
[2025-11-18 09:38:52 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "GET /cpsess2402986023/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<sIupv91DzuuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 09:39:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<RP0qwt1Dqo5SczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.103.66
country_id: 1835841
description:
2025-11-18 09:40:08 dovecot_login authenticator failed for ([175.205.103.66]) [175.205.103.66]:41107: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.146.95.34
country_id: 6252001
description:
2025-11-18 09:39:13 dovecot_login authenticator failed for 38-146-95-34.echocast.zone [38.146.95.34]:47093: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Lq5rwd1DaoyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.146.241
country_id: 2017370
description:
2025-11-18 09:40:21 dovecot_login authenticator failed for ([185.129.146.241]) [185.129.146.241]:38724: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.219.68.189
country_id: 3865483
description:
2025-11-18 09:40:27 dovecot_login authenticator failed for ([201.219.68.189]) [201.219.68.189]:45139: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<29kJxd1DHq+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.62.50.36
country_id: 298795
description:
2025-11-18 09:40:51 dovecot_login authenticator failed for (dynamic-195-62-50-36.cgnat.wi.hiperonline.com.tr) [195.62.50.36]:52908: 535 Incorrect authentication data (set_id=secretarioadjunto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 09:40:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<Katxw91DSuSl0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 09:40:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<lXRGxN1DxJUtPZWl>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gG2XyN1D9sGxV3kv>


