# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 17 23:40:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<oLXpYdVDyM0zTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-17 23:40:40 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:58846: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.236
country_id: 1668284
description:
2025-11-17 23:40:48 dovecot_login authenticator failed for 111-70-23-236.emome-ip.hinet.net [111.70.23.236]:37630: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2025-11-17 23:40:56 dovecot_login authenticator failed for ([61.72.58.242]) [61.72.58.242]:44712: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 23:41:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<9yYOZdVDVtWd5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 17 23:40:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<Ux/XYdVD4IuiAOAm>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9Nk/Y9VDfqGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 17 23:40:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<C9OMY9VDKNOB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 17 23:40:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<7T+yY9VDfOdrhr+5>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.134.148.59
country_id: 6252001
description:
Nov 17 23:40:48 hosting dovecot: pop3-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.134.148.59, lip=191.243.196.56, session=<w+A3ZNVDvuMDhpQ7>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+4HaZtVDHr6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 17 23:41:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<aLdbZ9VDrpkv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.196.148.169
country_id: 6252001
description:
2025-11-17 23:41:43 dovecot_login authenticator failed for (syn-024-196-148-169.res.spectrum.com) [24.196.148.169]:64407: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 23:41:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<1OrtZ9VDsNpCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 17 23:41:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<9wH0ZdVDAAWKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 23:41:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<hKeOZtVDKqwkMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2025-11-17 23:41:15 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:20852: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 189.4.11.149
country_id: 3469034
description:
[2025-11-17 23:41:18 -0300] info [webmaild] 189.4.11.149 - xavier@projetocircense.com.br "GET /cpsess4936433639/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2025-11-17 23:41:19 dovecot_login authenticator failed for ([118.220.149.121]) [118.220.149.121]:56912: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 189.4.11.149
country_id: 3469034
description:
[2025-11-17 23:41:50 -0300] info [webmaild] 189.4.11.149 - xavier@projetocircense.com.br "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.177
country_id: 2215636
description:
2025-11-17 23:42:03 dovecot_login authenticator failed for ([102.38.3.177]) [102.38.3.177]:51953: 535 Incorrect authentication data (set_id=wesley)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 23:41:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<Xk6jZ9VD4s4tPZWl>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:43:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HUgzbNVD9uCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 23:42:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<4OrZaNVDFI/SchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Nov 17 23:42:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomation.com>, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=<iaC/adVD+t7BHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 17 23:42:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<jzqFa9VDFpKElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 23:42:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<syama9VDmJFns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:42:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</vJuatVDBNaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 23:42:34 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51776: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 23:42:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<FMX6atVDrq2l0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 23:42:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<jCoka9VDDOuGx8nN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 218.76.73.4
country_id: 1814991
description:
Nov 17 23:43:12 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<bruno.garcia@deproi.com.br>, method=PLAIN, rip=218.76.73.4, lip=200.150.196.245, TLS, session=<bFl/a9VDfnXaTEkE>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tb//bdVDvoGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-17 23:43:33 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:38790: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 60.8.73.174
country_id: 1814991
description:
Nov 17 23:43:36 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<bruno.garcia>, method=PLAIN, rip=60.8.73.174, lip=200.150.196.245, TLS, session=<7z/wbNVD8NQ8CEmu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
country_id: 2017370
description:
2025-11-17 23:43:50 dovecot_login authenticator failed for ([178.178.222.56]) [178.178.222.56]:37176: 535 Incorrect authentication data (set_id=bruno)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 23:44:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<tnX0b9VDiIFn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.19.170
country_id: 1269750
description:
2025-11-17 23:44:23 dovecot_login authenticator failed for ([103.68.19.170]) [103.68.19.170]:56978: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0euIcdVDupmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
country_id: 2635167
description:
2025-11-17 23:44:48 dovecot_plain authenticator failed for (localhost.localdomain) [78.153.140.202]:52254: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2025-11-17 23:45:01 dovecot_login authenticator failed for ([174.134.45.64]) [174.134.45.64]:33772: 535 Incorrect authentication data (set_id=eleicoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 69.62.65.113
country_id: 597427
description:
Nov 17 23:44:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@transol.com.br>, method=PLAIN, rip=69.62.65.113, lip=200.150.196.245, session=<d9DCcdVD6s1FPkFx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-11-17 23:44:40 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:55834: 535 Incorrect authentication data (set_id=doninha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-11-17 23:44:48 dovecot_login authenticator failed for ([128.185.169.25]) [125.19.195.66]:41020: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 17 23:45:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<LI6vddVDeslSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.109.208
country_id: 1819730
description:
2025-11-17 23:45:48 dovecot_login authenticator failed for (182.239.109.208.hk.chinamobile.com) [182.239.109.208]:42408: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.45.116.182
country_id: 2017370
description:
2025-11-17 23:45:51 dovecot_login authenticator failed for ([178.45.116.182]) [178.45.116.182]:5060: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2025-11-17 23:45:55 dovecot_login authenticator failed for ([218.156.93.202]) [218.156.93.202]:53093: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2025-11-17 23:45:59 dovecot_login authenticator failed for (95.158.39.201.bestsolution.net.ua) [95.158.39.201]:44658: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:46:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NNrldtVDJL6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 23:45:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@f5assessoria.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<G4m5dNVDguZ2wSaf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:45:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dzwqddVD4q2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 23:46:00 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51799: 535 Incorrect authentication data (set_id=contato@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.61.238
country_id: 1814991
description:
2025-11-17 23:46:21 dovecot_login authenticator failed for ([111.26.61.237]) [111.26.61.238]:37124: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.161.145
country_id: 3469034
description:
2025-11-17 23:46:24 dovecot_login authenticator failed for (csbrasil.static.gvt.net.br) [179.185.161.145]:35028: 535 Incorrect authentication data (set_id=rene)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 23:46:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<hdsteNVDFJGUcQQF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mIG1eNVDVMaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 17 23:46:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<R/OAedVDl8y317Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.137.75.227
country_id: 3017382
description:
2025-11-17 23:46:08 dovecot_login authenticator failed for (4-229-254-46.reverse.alphalink.fr) [185.137.75.227]:43422: 535 Incorrect authentication data (set_id=rene@globalmedica.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 23:46:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<90cieNVD4stns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 23:46:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<VVHDeNVDkt3SchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 23:47:26 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:58659: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 23:47:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<Zfa9e9VDPrF3xBIC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kMdEfNVDYt6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2025-11-17 23:47:41 dovecot_login authenticator failed for ([213.230.65.53]) [213.230.65.53]:41748: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.154.166
country_id: 1814991
description:
2025-11-17 23:48:03 dovecot_login authenticator failed for ([122.224.154.166]) [122.224.154.166]:34358: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 17 23:48:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<Y3UfftVDzotCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.164.107.3
country_id: 2510769
description:
2025-11-17 23:47:21 dovecot_login authenticator failed for (3.pool90-164-107.dynamic.orange.es) [90.164.107.3]:47441: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
country_id: 1835841
description:
2025-11-17 23:47:28 dovecot_login authenticator failed for ([112.168.71.109]) [112.168.71.109]:56576: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.154
country_id: 1668284
description:
2025-11-17 23:47:36 dovecot_login authenticator failed for 111-70-19-154.emome-ip.hinet.net [111.70.19.154]:51599: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 23:47:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<n1vSfNVDfJFA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 23:47:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<UlMIfdVDKKGl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.25.48
country_id: 1668284
description:
2025-11-17 23:47:51 dovecot_login authenticator failed for 111-70-25-48.emome-ip.hinet.net [111.70.25.48]:54539: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:49:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xxqngdVD1IixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2025-11-17 23:49:03 dovecot_login authenticator failed for ([1.237.155.150]) [1.237.155.150]:40208: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 17 23:48:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<5t1PftVDCqKB4kCN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mILXf9VD9oCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 17 23:48:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ieq.com.br>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<r2XYgNVD+sqnR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 17 23:48:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<qA8ugdVDlOcO4dKR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.117.131
country_id: 3144096
description:
2025-11-17 23:48:14 dovecot_login authenticator failed for (cm-46.212.117.131.get.no) [46.212.117.131]:43725: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.100.48
country_id: 1814991
description:
2025-11-17 23:48:16 dovecot_login authenticator failed for ([36.135.100.47]) [36.135.100.48]:56940: 535 Incorrect authentication data (set_id=wesley)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-17 23:48:38 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:53122: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.85.118.147
country_id: 1814991
description:
2025-11-17 23:49:23 dovecot_login authenticator failed for ([111.85.118.147]) [111.85.118.147]:35057: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 17 23:49:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<6n5qg9VDoJdrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-17 23:49:45 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51641: 535 Incorrect authentication data (set_id=curitiba@asscar.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.61.177.2
country_id: 1814991
description:
Nov 17 23:49:53 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@adlondrina.com.br>, method=PLAIN, rip=111.61.177.2, lip=200.150.196.245, TLS, session=<ddVHg9VDaLVvPbEC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 23:49:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<ACPegtVDCOhn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-17 23:49:30 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:12995: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<H61zg9VDCpKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 23:49:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<QiF2g9VDxp8XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-11-17 23:49:57 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:44130: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 17 23:50:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<dx+NhtVD2rEtPZWl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:50:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gZcLh9VD3KqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.40.196.85
country_id: 3175395
description:
2025-11-17 23:50:37 dovecot_login authenticator failed for net-2-40-196-85.cust.vodafonedsl.it [2.40.196.85]:45730: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.99.148.119
country_id: 6252001
description:
2025-11-17 23:50:48 dovecot_login authenticator failed for ([167.99.148.119]) [167.99.148.119]:33046: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 17 23:50:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<XRo4iNVDuKw+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.131.216.81
country_id: 660013
description:
2025-11-17 23:50:18 dovecot_login authenticator failed for dynamic-216-81.keskikaista.fi [185.131.216.81]:55188: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:52:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</wBdjNVD+sqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 17 23:51:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<xjUiidVD6ISUcQQF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JsWXitVD2sKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 23:51:49 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:51448: 535 Incorrect authentication data (set_id=postamster@calcautomacao.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 23:52:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<2v+njdVDlkqvfiX3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dTQwjtVDFNmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.132
country_id: 2510769
description:
2025-11-17 23:52:50 dovecot_login authenticator failed for (109-69-15-132.puntdacces.coop) [109.69.15.132]:35845: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Hmi6kdVDPOuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.254.91
country_id: 3865483
description:
2025-11-17 23:53:33 dovecot_login authenticator failed for (static.91.254.104.190.cps.com.ar) [190.104.254.91]:38489: 535 Incorrect authentication data (set_id=novamanha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.245.182
country_id: 1269750
description:
2025-11-17 23:53:11 dovecot_login authenticator failed for ([152.52.234.134]) [125.20.245.182]:57550: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.209.251.170
country_id: 3469034
description:
Nov 17 23:53:12 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos@maringasoldas.com.br>, method=PLAIN, rip=186.209.251.170, lip=200.150.196.245, TLS, session=<OAJ+j9VDPue60fuq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.24.40
country_id: 2017370
description:
2025-11-17 23:53:14 dovecot_login authenticator failed for ([46.44.24.40]) [46.44.24.40]:54835: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 23:53:16 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:58915: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.255.234.87
country_id: 130758
description:
Nov 17 23:54:29 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=37.255.234.87, lip=200.150.196.245, TLS, session=<uVsJlNVDatsl/+pX>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:54:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</URZldVDEpSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 23:54:55 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:58419: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 17 23:54:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@oabsjp.org.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<jyPTltVD7OR2wSaf>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:55:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8QQbl9VDXpuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 17 23:55:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<mMUpl9VDKrYrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.70.31.135
country_id: 1668284
description:
Nov 17 23:54:09 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@adlondrina.com.br>, method=PLAIN, rip=111.70.31.135, lip=200.150.196.245, TLS, session=<SBBbktVD3sBvRh+H>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 23:55:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<ol4DmNVDALpSnOdL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5zvfmNVDcKuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 17 23:55:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<dq6CmdVDULVw2eny>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 119.28.107.251
country_id: 1880251
description:
[2025-11-17 23:56:01 -0300] info [cpaneld] 119.28.107.251 - lixadora "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lixadora (has_cpuser_file failed)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 17 23:55:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@brinquelocacoes.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<IeSCl9VDOrYrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 17 23:55:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<XQ4emNVDPNnBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.31.138.38
country_id: 3469034
description:
2025-11-17 23:56:00 dovecot_plain authenticator failed for 189-31-138-38.user3p.v-tal.net.br ([192.168.56.1]) [189.31.138.38]:62449: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.138.214
country_id: 290557
description:
2025-11-17 23:56:03 dovecot_login authenticator failed for ([80.227.138.214]) [80.227.138.214]:44672: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.19.170
country_id: 1269750
description:
2025-11-17 23:56:38 dovecot_login authenticator failed for ([103.68.19.170]) [103.68.19.170]:35501: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-11-17 23:56:58 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:52864: 535 Incorrect authentication data (set_id=brizola)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.95.11
country_id: 1562822
description:
2025-11-17 23:57:01 dovecot_login authenticator failed for ([210.245.95.11]) [210.245.95.11]:47502: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-11-17 23:56:11 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:45472: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-17 23:56:12 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:65492: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+RZ3nNVDVL6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 23:57:09 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:49376: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.204.31
country_id: 1814991
description:
2025-11-17 23:57:41 dovecot_login authenticator failed for ([220.180.204.31]) [220.180.204.31]:49914: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 23:57:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<1bUYodVDGMul0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 17 23:58:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<TkPUodVDUp5SczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.106.59.245
country_id: 1835841
description:
2025-11-17 23:57:20 dovecot_login authenticator failed for ([183.106.59.245]) [183.106.59.245]:45985: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-11-17 23:57:29 dovecot_login authenticator failed for ([14.99.61.248]) [14.99.61.248]:41122: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1TIMoNVDjNSxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:58:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gPTaodVDOOKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-11-17 23:58:55 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:37824: 535 Incorrect authentication data (set_id=novamanha)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 17 23:58:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<sgMKpdVDOoUrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 17 23:58:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<Ge82otVDM953xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.197.9.42
country_id: 3175395
description:
Nov 17 23:58:24 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<novidadevida>, method=PLAIN, rip=185.197.9.42, lip=200.150.196.245, TLS, session=<XTT1odVD6be5xQkq>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vHufo9VDCu2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.166.62
country_id: 2017370
description:
2025-11-17 23:58:41 dovecot_login authenticator failed for (dynamicip-109-195-166-62.pppoe.ryazan.ertelecom.ru) [109.195.166.62]:60346: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 23:59:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<jb3Vp9VDRrAkMrBu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 17 23:59:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<Tn77pdVD0LFbejg7>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 23:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1y4tp9VD3pOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 17 23:59:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<lZMMp9VD+K0v+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 17 23:59:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<hKW2p9VDlqqYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 00:00:55 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52260: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 00:00:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<Vq32q9VDmsxA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 00:00:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<uTX9q9VD1q4tPZWl>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:01:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kUGXrNVD0LqxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rFPEqtVDJrGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 00:00:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<Mbh9q9VDAOxns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 00:02:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<4rX1r9VD8LItPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-11-18 00:01:34 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:58736: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-11-18 00:01:46 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:57004: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.102.254.198
country_id: 2017370
description:
2025-11-18 00:01:52 dovecot_login authenticator failed for ([86.102.254.198]) [86.102.254.198]:36152: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2025-11-18 00:01:39 dovecot_login authenticator failed for host-24-207-66-154.public.eastlink.ca [24.207.66.154]:46328: 535 Incorrect authentication data (set_id=vanessalima)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2025-11-18 00:01:44 dovecot_login authenticator failed for ([13.68.214.34]) [13.68.214.34]:54692: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2025-11-18 00:01:58 dovecot_login authenticator failed for ([189.113.185.14]) [189.113.185.14]:40634: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 00:01:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<BFhjrdVDTMc7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
country_id: 1269750
description:
2025-11-18 00:01:26 dovecot_login authenticator failed for ([45.250.249.12]) [45.250.249.12]:43486: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.254
country_id: 1814991
description:
2025-11-18 00:01:27 dovecot_login authenticator failed for ([111.26.95.253]) [111.26.95.254]:51920: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<LI9VrtVDzsWxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.85
country_id: 2635167
description:
Nov 18 00:02:20 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.85, lip=200.150.207.122, TLS, session=<rAU1sdVDF+hX7LBV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-11-18 00:02:24 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:50825: 535 Incorrect authentication data (set_id=lucas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XvXssdVDWOOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 00:02:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@highqualityautoparts.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<+BgwstVDxIE+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.146.47.227
country_id: 2017370
description:
2025-11-18 00:02:13 dovecot_login authenticator failed for (net47-227.perm.ertelecom.ru) [46.146.47.227]:50210: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:04:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tCtIt9VDcKGxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5z9+tdVDdpexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-11-18 00:03:40 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:32964: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 00:03:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<9rVRttVDkMnBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.4.36
country_id: 1269750
description:
2025-11-18 00:03:51 dovecot_login authenticator failed for (cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:47614: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.202.219.223
country_id: 1814991
description:
2025-11-18 00:03:59 dovecot_login authenticator failed for ([218.202.219.223]) [218.202.219.223]:36156: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-11-18 00:04:17 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:43579: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-11-18 00:04:31 dovecot_login authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:55373: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<wYEZudVDJq6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-18 00:04:33 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br [187.40.215.162]:47501: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.180.252.183
country_id: 6252001
description:
2025-11-18 00:04:48 dovecot_login authenticator failed for ([208.180.252.183]) [208.180.252.183]:35997: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 00:04:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<D6FNuNVDsOSGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-11-18 00:05:02 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:47674: 535 Incorrect authentication data (set_id=vanessalima)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.105.71.106
country_id: 1814991
description:
2025-11-18 00:05:24 dovecot_login authenticator failed for ([223.105.71.106]) [223.105.71.106]:50165: 535 Incorrect authentication data (set_id=rubens@singseguros.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gAyjvNVDFsmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 00:05:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<mSCevNVDQMMv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.74.74.44
country_id: 1814991
description:
2025-11-18 00:05:54 dovecot_login authenticator failed for ([39.74.74.44]) [39.74.74.44]:54734: 535 Incorrect authentication data (set_id=rubens)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2025-11-18 00:06:06 dovecot_login authenticator failed for ([189.59.210.1]) [186.215.245.175]:59177: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.59.34.5
country_id: 1814991
description:
2025-11-18 00:05:35 dovecot_login authenticator failed for ([113.59.34.8]) [113.59.34.5]:42605: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2025-11-18 00:05:38 dovecot_login authenticator failed for (119.92.76.210.static.pldt.net) [119.92.76.210]:34316: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-11-18 00:05:46 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:33624: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-18 00:05:46 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:53466: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-18 00:05:59 H=(195.3.134.135) [179.0.178.53]:61657 F=<erictremblaysi@hotmail.com> rejected RCPT <amiguinhos@transol.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:61657 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2025-11-18 00:06:14 dovecot_login authenticator failed for ([65.20.158.10]) [65.20.158.10]:60471: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.8.209.94
country_id: 1814991
description:
2025-11-18 00:06:29 dovecot_login authenticator failed for ([121.8.209.94]) [121.8.209.94]:55858: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<N1k5wNVDmuOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-18 00:06:52 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:56031: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.104.162
country_id: 1814991
description:
2025-11-18 00:06:54 dovecot_login authenticator failed for ([36.112.104.162]) [36.112.104.162]:56956: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:07:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<K9IJwtVD9OuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.233.6.238
country_id: 1814991
description:
2025-11-18 00:06:13 dovecot_login authenticator failed for ([116.230.66.81]) [116.233.6.238]:51766: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2025-11-18 00:07:14 dovecot_login authenticator failed for ([111.61.177.187]) [111.61.177.187]:30790: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.169.28.244
country_id: 2017370
description:
2025-11-18 00:07:16 dovecot_login authenticator failed for 28.244.inn361.ru [193.169.28.244]:55307: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2025-11-18 00:07:28 dovecot_login authenticator failed for ([183.167.193.127]) [183.167.193.127]:41795: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-11-18 00:07:43 dovecot_login authenticator failed for ([128.185.23.89]) [125.19.160.206]:48620: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.186.172.37
country_id: 1814991
description:
2025-11-18 00:07:09 dovecot_login authenticator failed for ([60.186.172.37]) [60.186.172.37]:53947: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2+/Kw9VDxIuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.255.146
country_id: 1814991
description:
2025-11-18 00:07:57 dovecot_login authenticator failed for ([222.170.255.146]) [222.170.255.146]:43595: 535 Incorrect authentication data (set_id=flavio.oliveira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-11-18 00:07:14 dovecot_login authenticator failed for (nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:48986: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.104.76.94
country_id: 1835841
description:
2025-11-18 00:07:12 dovecot_login authenticator failed for ([222.104.76.94]) [222.104.76.94]:56558: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2025-11-18 00:07:36 dovecot_login authenticator failed for ([211.169.212.206]) [211.169.212.206]:62643: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.40.62.72
country_id: 2635167
description:
2025-11-18 00:07:12 dovecot_login authenticator failed for 92.40.62.72.threembb.co.uk [92.40.62.72]:39714: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-18 00:08:06 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:50944: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-11-18 00:07:32 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.154.175]:55462: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cg5dx9VDdp6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.245.141.225
country_id: 2077456
description:
2025-11-18 00:08:41 dovecot_login authenticator failed for 61-245-141-225.3df58d.per.nbn.aussiebb.net [61.245.141.225]:34155: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.56.116
country_id: 3017382
description:
2025-11-18 00:08:58 dovecot_login authenticator failed for laubervilliers-657-1-120-116.w80-14.abo.wanadoo.fr [80.14.56.116]:37859: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.245.120
country_id: 1814991
description:
2025-11-18 00:08:18 dovecot_login authenticator failed for (120.245.223.60.adsl-pool.sx.cn) [60.223.245.120]:43686: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 00:08:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<FVIWx9VD0oonaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.225.207.166
country_id: 1814991
description:
2025-11-18 00:08:42 dovecot_login authenticator failed for ([111.225.207.166]) [111.225.207.166]:44898: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.121.175.167
country_id: 1835841
description:
2025-11-18 00:09:00 dovecot_login authenticator failed for ([58.121.175.167]) [58.121.175.167]:50294: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-18 00:09:15 dovecot_login authenticator failed for (vidaengenharia.com.br) [112.122.54.54]:1082: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.72.202.86
country_id: 192950
description:
2025-11-18 00:09:18 dovecot_login authenticator failed for ([41.72.201.170]) [41.72.202.86]:51068: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 18 00:09:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<8LZqytVD2JZ57bKF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-18 00:09:25 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:53640: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.225.134.13
country_id: 1835841
description:
2025-11-18 00:09:31 dovecot_login authenticator failed for ([182.225.134.13]) [182.225.134.13]:51633: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fCP6ytVDWrixV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:10:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Yla6zNVDlMGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 00:10:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<E3kWzdVDIMBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 00:10:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<FVJwzdVDWIed5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-18 00:10:30 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:62955: 535 Incorrect authentication data (set_id=processos.daniel@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:10:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vdSSztVD8NKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 00:10:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<51Ikz9VD1OgnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.39.230.40
country_id: 1835841
description:
2025-11-18 00:10:45 dovecot_login authenticator failed for ([118.39.230.40]) [118.39.230.40]:4259: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.171.27.248
country_id: 1814991
description:
2025-11-18 00:10:59 dovecot_login authenticator failed for ([116.171.27.248]) [116.171.27.248]:36436: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 00:11:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<nO2k0NVDgixo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 00:11:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<Zmo70dVDmK1vAEul>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 18 00:11:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<Dfj10NVDHk0kMrGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 00:11:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<pUgx0dVDXON9gnHM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:11:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UzQm0tVDQuaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 00:11:35 dovecot_login authenticator failed for (User) [177.74.174.120]:59644: 535 Incorrect authentication data (set_id=alves@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.121.99
country_id: 1814991
description:
2025-11-18 00:11:36 dovecot_login authenticator failed for ([111.53.121.99]) [111.53.121.99]:43295: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.238.2.7
country_id: 3469034
description:
2025-11-18 00:12:02 dovecot_login authenticator failed for 45-238-2-7.netmaisfibra.net.br [45.238.2.7]:44094: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2025-11-18 00:12:40 dovecot_login authenticator failed for (dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [125.23.155.110]:36342: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 00:12:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<6Grm1tVD6qSkXF7M>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:13:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+MN019VDZJyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.115.29.39
country_id: 1835841
description:
2025-11-18 00:12:14 dovecot_login authenticator failed for ([175.115.29.39]) [175.115.29.39]:35438: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.144.14.204
country_id: 1210997
description:
2025-11-18 00:12:30 dovecot_login authenticator failed for (14.204.bol-online.com) [122.144.14.204]:61544: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 00:12:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<3inE1tVDto1SnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-18 00:12:55 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:57061: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 00:12:08 dovecot_login authenticator failed for (User) [177.74.174.120]:59644: 535 Incorrect authentication data


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:12:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<l5C51dVDHJCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 18 00:13:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<4KZV2NVD/Jcv+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 00:13:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<8V+y2NVDEteYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.98.235.34
country_id: 1814991
description:
2025-11-18 00:13:37 dovecot_login authenticator failed for ([114.98.235.34]) [114.98.235.34]:34182: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 00:13:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<ouB02tVDKsEI1et7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 00:13:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<hElJ2NVDWKsXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-18 00:13:22 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:47782: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 00:13:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<6QPL2dVDvulCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.83.124.138
country_id: 1814991
description:
2025-11-18 00:13:33 dovecot_login authenticator failed for ([1.83.124.138]) [1.83.124.138]:10261: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 18 00:13:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<p5pZ2NVD+oudQi/y>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8+pH2dVDGKmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 00:13:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<7rGZ2dVD9tB3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.143.88
country_id: 1819730
description:
2025-11-18 00:13:44 dovecot_login authenticator failed for (m121-202-143-88.smartone.com) [121.202.143.88]:53570: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.119
country_id: 1269750
description:
2025-11-18 00:14:58 dovecot_login authenticator failed for (nsg-corporate-119.229.187.122.airtel.in) [122.187.229.119]:52389: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.6
country_id: 1668284
description:
2025-11-18 00:14:18 dovecot_login authenticator failed for 111-70-32-6.emome-ip.hinet.net [111.70.32.6]:37506: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 00:14:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<M8p83NVDAlto7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<aS/b3NVDOL+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 00:14:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<JSPF3dVDMOaKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.97.119.87
country_id: 1814991
description:
2025-11-18 00:15:27 dovecot_login authenticator failed for ([211.97.119.87]) [211.97.119.87]:2336: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XRxy4NVDyNKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 00:15:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<590E4dVDVoGYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.134.58
country_id: 1269750
description:
2025-11-18 00:15:55 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:59748: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2025-11-18 00:15:57 dovecot_login authenticator failed for ([65.20.250.163]) [65.20.250.163]:43020: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 00:16:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pousadarincaoalegre.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<wnCT4dVDmshzR+4E>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:16:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OeMz4tVD1OOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 00:15:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<UoMC39VDDMsI2Cjk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.51.87.9
country_id: 1814991
description:
2025-11-18 00:15:46 dovecot_login authenticator failed for ([59.51.87.9]) [59.51.87.9]:54030: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 00:15:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<ekeO4dVDaINAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-11-18 00:16:05 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:41707: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 00:15:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<3WHP3tVDpMSl0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 00:16:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<6tiS49VDMLx9gnHM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5ZUE5NVDSu2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.41.217
country_id: 2077456
description:
2025-11-18 00:16:33 dovecot_login authenticator failed for 110-175-41-217.static.tpgi.com.au [110.175.41.217]:51160: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.74.74.44
country_id: 1814991
description:
2025-11-18 00:16:37 dovecot_login authenticator failed for ([39.74.74.44]) [39.74.74.44]:47260: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 00:16:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<GncK5dVD9O1vAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.24.40
country_id: 2017370
description:
2025-11-18 00:16:12 dovecot_login authenticator failed for (46-44-24-40.silinet.ru) [46.44.24.40]:63102: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-11-18 00:16:21 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:57986: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.116
country_id: 1269750
description:
2025-11-18 00:16:23 dovecot_login authenticator failed for (nsg-corporate-116.230.187.122.airtel.in) [122.187.230.116]:45303: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 18 00:16:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<iS0p5dVDYKGiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.70.151
country_id: 1814991
description:
2025-11-18 00:16:09 dovecot_login authenticator failed for ([171.217.70.151]) [171.217.70.151]:33400: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.253.242
country_id: 3382998
description:
2025-11-18 00:16:17 dovecot_login authenticator failed for ([186.179.253.242]) [186.179.253.242]:35960: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2025-11-18 00:17:13 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:50028: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UESZ59VDSpexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 00:17:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<o5nD6NVD4Odn9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PIMs69VDrqqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.123.116.93
country_id: 1814991
description:
2025-11-18 00:18:38 dovecot_login authenticator failed for ([118.123.116.93]) [118.123.116.93]:35556: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 00:18:50 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:55441: 535 Incorrect authentication data (set_id=serivce@cleservicosindustriais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.181
country_id: 2186224
description:
2025-11-18 00:18:51 dovecot_login authenticator failed for ([121.73.163.181]) [121.73.163.181]:41076: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:19:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hUXz7NVDpLixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 00:18:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<pixU6tVDPKhns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 00:19:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<s5Z67tVD0s8rmxBp>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tra/7tVDmsCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 00:19:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<X5ow79VDlqeB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 00:19:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<55+O7dVDFqid5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 220.178.39.106
country_id: 1814991
description:
Nov 18 00:21:04 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@deproi.com.br>, method=PLAIN, rip=220.178.39.106, lip=200.150.196.245, TLS, session=<vVPS8tVD4Yjcsidq>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 00:20:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<cuEL8dVDhpiKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 00:20:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@f5assessoria.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<YG928tVDiJKkXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 216.194.174.27
country_id: 6252001
description:
Nov 18 00:20:41 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@deproi.com.br>, method=PLAIN, rip=216.194.174.27, lip=200.150.196.245, TLS, session=<GPXE8dVDye/Ywq4b>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rbpR8tVDoNmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.26.31.62
country_id: 1814991
description:
Nov 18 00:21:01 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@deproi.com.br>, method=PLAIN, rip=121.26.31.62, lip=200.150.196.245, TLS, session=<0gPM8tVDeil5Gh8+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 00:20:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<gcJO8dVDbtqP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 18 00:20:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<dJVm8dVDzM0zTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 00:20:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@primiciapersianas.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<pNBy8dVDDtx2wSaf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5lDf9dVDZoOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.78
country_id: 2328926
description:
2025-11-18 00:21:33 dovecot_login authenticator failed for (netcomafrica.com) [41.219.149.78]:65491: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:22:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<f66l99VDUo2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.61.176.243
country_id: 1814991
description:
Nov 18 00:21:27 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=111.61.176.243, lip=200.150.196.245, TLS, session=<AzND9NVDUvZvPbDz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 00:21:13 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:55030: 535 Incorrect authentication data (set_id=admin@jacgeneralcleaning.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 120.28.151.87
country_id: 1694008
description:
Nov 18 00:21:39 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=120.28.151.87, lip=200.150.196.245, TLS, session=<kFj09NVDgdx4HJdX>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.238.15.224
country_id: 1835841
description:
2025-11-18 00:21:50 dovecot_login authenticator failed for ([218.238.15.224]) [218.238.15.224]:34096: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.105.166.200
country_id: 1814991
description:
2025-11-18 00:22:07 dovecot_login authenticator failed for ([36.105.166.200]) [36.105.166.200]:47416: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.64.30.151
country_id: 1643084
description:
Nov 18 00:21:07 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=36.64.30.151, lip=200.150.196.245, TLS, session=<ODAD89VDhJgkQB6X>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 00:22:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<gqgd+dVDqISElIx5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<G/1u+dVDypWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.29.143
country_id: 798544
description:
Nov 18 00:22:38 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas>, method=PLAIN, rip=178.216.29.143, lip=200.150.196.245, TLS, session=<m767+NVD0diy2B2P>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 00:23:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<S1nk+9VDNrKB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 00:23:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<IlV8/NVDqIJCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.137.75.227
country_id: 3017382
description:
2025-11-18 00:23:41 dovecot_login authenticator failed for (4-229-254-46.reverse.alphalink.fr) [185.137.75.227]:58378: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
country_id: 3923057
description:
2025-11-18 00:23:48 dovecot_login authenticator failed for (SCZ-181-188-149-00243.tigo.bo) [181.188.149.243]:54104: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.0.238.190
country_id: 3469034
description:
2025-11-18 00:24:02 dovecot_login authenticator failed for (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [177.0.238.190]:39760: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 00:23:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<XIHI+9VDkJMv7PP+>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VcYJ/dVDTq6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.179.128
country_id: 3996063
description:
2025-11-18 00:24:01 dovecot_login authenticator failed for ([140.84.179.128]) [140.84.179.128]:38844: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.243.245.4
country_id: 3996063
description:
2025-11-18 00:23:10 H=([127.0.1.1]) [104.243.245.4]:43600 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=<noviembred@outlook.com> rejected RCPT <ventas@empresasmexico.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 00:23:18 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51665: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-11-18 00:23:41 dovecot_login authenticator failed for ([61.72.59.106]) [61.72.59.106]:42503: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 00:23:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@primiciapersianas.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<OSKn/dVD5tukXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-11-18 00:23:09 dovecot_login authenticator failed for ([187.50.122.20]) [177.61.176.110]:33000: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.170.40.231
country_id: 2017370
description:
2025-11-18 00:23:12 dovecot_login authenticator failed for ([188.170.40.231]) [188.170.40.231]:50741: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:25:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VzBsAtZDcs6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2025-11-18 00:25:02 dovecot_login authenticator failed for (64-49-97-15.protekweb.com) [64.49.97.15]:36088: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 00:24:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<K+nqANZDFKal0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
country_id: 2635167
description:
2025-11-18 00:25:00 dovecot_plain authenticator failed for (localhost.localdomain) [78.153.140.202]:59244: 535 Incorrect authentication data (set_id=anderson@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 00:25:00 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55690: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 00:24:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<5tV+ANZDnrUkMrBu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 00:24:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<vy8jAdZDaujSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.158.205.225
country_id: 1861060
description:
2025-11-18 00:24:49 dovecot_login authenticator failed for kd113158205225.ppp-bb.dion.ne.jp [113.158.205.225]:51282: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-18 00:25:07 dovecot_login authenticator failed for ([189.57.81.137]) [186.201.54.90]:51663: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 00:24:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<Kl0jANZD3M9ns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 00:24:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<jTItANZDBMctPZWl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Y6WbANZDRMaxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<stAuBNZDIt6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.221.225.104
country_id: 1814991
description:
2025-11-18 00:25:42 dovecot_login authenticator failed for ([171.221.225.104]) [171.221.225.104]:25325: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 00:25:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<Lzp8BdZDmoNSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-18 00:26:04 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:54991: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 00:25:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<5fKbAtZDZNtrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2025-11-18 00:25:13 dovecot_login authenticator failed for ([211.53.58.1]) [211.169.212.206]:53174: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2025-11-18 00:25:27 dovecot_login authenticator failed for ([37.210.246.54]) [37.210.246.54]:55600: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-11-18 00:25:32 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:60226: 535 Incorrect authentication data (set_id=desenvolvimento2)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 00:25:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fernandotonet.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<k7pcBNZDgp+kXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 00:25:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<MPeCBdZD1Odn9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qlzCB9ZDOIGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 00:27:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<gmRWCdZDmOCUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.100.48
country_id: 241170
description:
Nov 18 00:27:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contato@calcautomacao.com.br>, method=PLAIN, rip=196.251.100.48, lip=200.150.196.245, session=<W9ZmCdZDWNDE+2Qw>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.242.105
country_id: 2750405
description:
2025-11-18 00:26:28 H=([91.92.242.105]) [91.92.242.105]:52095 F=<info@uniworldrivercruises.co.uk> rejected RCPT <jacaresdoasfalto@ieq.com.br>: Nenhuma pessoa no endereço.


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:28:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<T3QmDdZDmqaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 00:28:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<cR8WDdZDsOU+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.100.48
country_id: 241170
description:
Nov 18 00:27:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contato@cargopoint.com.br>, method=PLAIN, rip=196.251.100.48, lip=200.150.196.245, session=<PwmmCdZDmLnE+2Qw>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bNVVC9ZDDpuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 00:27:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<w1qnDNZD6J5ns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 00:27:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<t1HJDNZD/IlA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-11-18 00:29:06 dovecot_login authenticator failed for ([94.205.250.78]) [94.205.250.78]:56579: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 196.251.100.48
country_id: 241170
description:
Nov 18 00:28:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contato@globalmedica.com.br>, method=PLAIN, rip=196.251.100.48, lip=200.150.196.245, session=<PJ6WDtZDMLTE+2Qw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 00:28:28 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:55594: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<eUjwDtZDrrSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.67.189
country_id: 3469034
description:
2025-11-18 00:28:37 dovecot_login authenticator failed for (unicred.static.gvt.net.br) [177.135.67.189]:47227: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 00:28:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<tRhjD9ZDV7t3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 00:29:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@alcantaraemonteiro.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<7BKrEdZD3t92wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2025-11-18 00:29:23 dovecot_login authenticator failed for c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:60512: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 00:29:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<Oe/XEtZDHLNCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.34.2.179
country_id: 2017370
description:
2025-11-18 00:29:43 dovecot_login authenticator failed for ([77.34.2.179]) [77.34.2.179]:59962: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.167
country_id: 2186224
description:
2025-11-18 00:29:56 dovecot_login authenticator failed for ([121.73.169.167]) [121.73.169.167]:38168: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 00:29:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<TTYYEdZDzMjSchJs>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AHKEEtZDTMyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-11-18 00:30:01 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:39434: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2025-11-18 00:29:12 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:47618: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:31:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TH3ZF9ZDMoCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 00:31:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<rcWwF9ZD4rgO4dKR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2025-11-18 00:30:10 dovecot_login authenticator failed for ([61.72.101.1]) [61.72.58.242]:33922: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 00:30:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<oaYhFdZD5I6l0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 00:30:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@brinquelocacoes.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<jGi8FtZD5tJzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 00:30:54 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:55869: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-18 00:31:02 dovecot_login authenticator failed for ([189.57.81.137]) [186.201.54.90]:41254: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 00:30:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<43QiFdZDXu1w2eny>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.223.187.146
country_id: 1814991
description:
2025-11-18 00:30:31 dovecot_login authenticator failed for ([222.223.187.146]) [222.223.187.146]:49459: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.132.133.54
country_id: 1269750
description:
2025-11-18 00:30:43 dovecot_login authenticator failed for (dsl-del-dynamic-073.72.246.61.airtelbroadband.in) [203.132.133.54]:41598: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
country_id: 2017370
description:
2025-11-18 00:30:45 dovecot_login authenticator failed for (92x255x190x69.static-business.omsk.ertelecom.ru) [92.255.190.69]:53270: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2025-11-18 00:31:04 dovecot_login authenticator failed for ([221.145.5.14]) [221.145.5.14]:50876: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+VoNFtZDPt+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 00:30:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<gA/kFtZDVtCB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 00:31:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<a6oNGNZD/Lg+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 00:31:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<ZfMWGNZDoNRn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.33.248
country_id: 6290252
description:
2025-11-18 00:31:11 dovecot_login authenticator failed for (dyn-33-248.kbcnet.rs) [109.207.33.248]:45373: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:31:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EdSrGdZDJomxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2025-11-18 00:31:34 dovecot_login authenticator failed for 89-67-37-219.dynamic.play.pl [89.67.37.219]:39247: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 00:31:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<Yk1NGtZDWOeUcQQF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xnc+HdZD7KCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
country_id: 458258
description:
2025-11-18 00:32:51 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:42942: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.10.56.129
country_id: 1835841
description:
2025-11-18 00:32:53 dovecot_login authenticator failed for ([59.10.56.129]) [59.10.56.129]:33104: 535 Incorrect authentication data (set_id=diretoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-11-18 00:32:12 dovecot_login authenticator failed for ([46.212.39.201]) [46.212.39.201]:36912: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.201.218.146
country_id: 1814991
description:
2025-11-18 00:32:14 dovecot_login authenticator failed for ([220.201.218.146]) [220.201.218.146]:47310: 535 Incorrect authentication data (set_id=diretoria@holdingsantahelena.agr.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 00:32:31 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:59400: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-11-18 00:32:37 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:60065: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.161.172
country_id: 1835841
description:
2025-11-18 00:32:38 dovecot_login authenticator failed for ([61.80.161.172]) [61.80.161.172]:57765: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 00:33:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<R5MiItZDfOI+PIOL>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:34:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rrCYItZDUsSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 00:33:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<us04H9ZDHMEtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.254.239
country_id: 953987
description:
2025-11-18 00:33:13 dovecot_login authenticator failed for ([102.23.254.239]) [102.23.254.239]:47817: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.208.188.232
country_id: 3175395
description:
Nov 18 00:33:24 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<jesse>, method=PLAIN, rip=185.208.188.232, lip=200.150.196.245, TLS, session=<b9pPH9ZDSdy50Lzo>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<GIDNINZD8rmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 00:33:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<12t+IdZDfJprhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.230.82.157
country_id: 2658434
description:
2025-11-18 00:34:22 dovecot_login authenticator failed for ([194.230.82.157]) [194.230.82.157]:56532: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2025-11-18 00:34:22 dovecot_login authenticator failed for (177-174-95-245.user.vivozap.com.br) [177.174.95.245]:49820: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2025-11-18 00:34:26 dovecot_login authenticator failed for ([115.141.143.58]) [115.141.143.58]:33351: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 00:34:30 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51971: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.179.135.174
country_id: 2661886
description:
2025-11-18 00:34:30 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:43788: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.119.19.172
country_id: 2510769
description:
2025-11-18 00:34:31 dovecot_login authenticator failed for ([93.119.19.172]) [93.119.19.172]:48634: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2025-11-18 00:34:44 dovecot_login authenticator failed for ([103.249.19.34]) [103.249.19.34]:36496: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 18 00:34:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<HSDUJdZD5mC317Oa>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QCNlJNZDHMyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-11-18 00:34:55 dovecot_login authenticator failed for ([203.193.147.37]) [203.193.147.37]:57997: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2025-11-18 00:35:00 dovecot_login authenticator failed for ([203.252.10.4]) [203.252.10.4]:53349: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<wsDtJ9ZDmOOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.152.206.155
country_id: 1814991
description:
2025-11-18 00:35:36 dovecot_login authenticator failed for ([219.152.206.155]) [219.152.206.155]:39210: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 00:35:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<LACIKNZDDusrmxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 00:35:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fernandotonet.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<SLMHKdZDrKd2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.16.192.32
country_id: 1835841
description:
2025-11-18 00:35:55 dovecot_login authenticator failed for ([59.16.192.32]) [59.16.192.32]:50264: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.35.120.169
country_id: 1814991
description:
2025-11-18 00:36:07 dovecot_login authenticator failed for ([58.35.120.169]) [58.35.120.169]:20678: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2025-11-18 00:36:15 H=(localhost.localdomain) [78.153.140.207]:39446 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.182.10
country_id: 1814991
description:
2025-11-18 00:36:11 dovecot_login authenticator failed for ([59.46.182.10]) [59.46.182.10]:52759: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 00:36:27 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51820: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 00:36:53 dovecot_login authenticator failed for (User) [177.74.174.120]:57376: 535 Incorrect authentication data (set_id=alves@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.135.218
country_id: 2510769
description:
2025-11-18 00:36:27 dovecot_login authenticator failed for (218.pool90-160-135.dynamic.orange.es) [90.160.135.218]:54940: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.213.16
country_id: 732800
description:
2025-11-18 00:36:30 dovecot_login authenticator failed for 95-87-213-16.ip.btc-net.bg [95.87.213.16]:39595: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Q96EK9ZDiIyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-11-18 00:36:38 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:16974: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.112.109.248
country_id: 6252001
description:
2025-11-18 00:36:41 dovecot_login authenticator failed for (host-24-112-109-248.vyvebroadband.net) [24.112.109.248]:37947: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:37:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8lRVLdZDvpSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.112.238
country_id: 2328926
description:
2025-11-18 00:37:02 dovecot_login authenticator failed for ([196.200.112.238]) [196.200.112.238]:3029: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-18 00:37:04 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:54745: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.73.3
country_id: 1819730
description:
2025-11-18 00:37:57 dovecot_login authenticator failed for 42-200-73-3.static.imsbiz.com [42.200.73.3]:60621: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 00:38:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<i6LqMNZDQKhSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.162.240.149
country_id: 1269750
description:
2025-11-18 00:37:10 dovecot_login authenticator failed for (abts-north-dynamic-149.240.162.122.airtelbroadband.in) [122.162.240.149]:45346: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 00:37:43 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51523: 535 Incorrect authentication data (set_id=nfe2@maringasoldas.com.br)


plugin: ossec
rule: 5706
name: SSH insecure connection attempt (scan).
abuser: 162.216.149.129
country_id: 6252001
description:
Nov 18 00:37:47 hosting sshd[31602]: Did not receive identification string from 162.216.149.129 port 60232


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2025-11-18 00:37:32 dovecot_login authenticator failed for ([128.185.227.142]) [128.185.227.142]:42606: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tpMWL9ZDDKCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.108.218
country_id: 2017370
description:
2025-11-18 00:37:46 dovecot_login authenticator failed for ([83.239.108.218]) [83.239.108.218]:55339: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.81.209.76
country_id: 2017370
description:
2025-11-18 00:37:50 dovecot_login authenticator failed for ([78.81.209.76]) [78.81.209.76]:49221: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 00:37:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<SnpwLdZD0CKvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 00:37:09 dovecot_login authenticator failed for (User) [177.74.174.120]:57376: 535 Incorrect authentication data (set_id=alves@inovasite.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2025-11-18 00:37:16 H=(localhost.localdomain) [78.153.140.207]:43120 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.236.202
country_id: 290557
description:
2025-11-18 00:38:57 dovecot_login authenticator failed for ([94.204.236.202]) [94.204.236.202]:39995: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 5706
name: SSH insecure connection attempt (scan).
abuser: 162.216.149.129
country_id: 6252001
description:
Nov 18 00:38:10 hosting sshd[32104]: Did not receive identification string from 162.216.149.129 port 58434


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 00:38:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<JxRhMdZDFsAv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.252.110
country_id: 1269750
description:
2025-11-18 00:38:29 dovecot_login authenticator failed for ([128.185.252.110]) [128.185.252.110]:57400: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ttCpMtZDrrmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.139.245.137
country_id: 1814991
description:
2025-11-18 00:38:31 dovecot_login authenticator failed for ([222.139.245.70]) [222.139.245.137]:39378: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 00:38:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<V8cPNNZDUM+YNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 18 00:39:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<cDZ+N9ZDxI5bejg7>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:40:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hPMMONZDrNmxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Q1Q8NtZDYNGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 00:39:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<QiAeNtZDfqql0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 18 00:39:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@joelbuenoadvogados.com.br>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<BXUTN9ZDtNorZDwA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.213
country_id: 2186224
description:
2025-11-18 00:39:54 dovecot_login authenticator failed for ([121.73.162.213]) [121.73.162.213]:53944: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 00:39:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<v25oNdZDOeh3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 00:40:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@oabsjp.org.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<g/nxN9ZDitOkXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2025-11-18 00:40:24 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:34189: 535 Incorrect authentication data (set_id=atendimento@lixadorajl.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-11-18 00:40:31 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:40392: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 00:40:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<CGLYOdZDhKNSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.211.174
country_id: 174982
description:
2025-11-18 00:40:50 dovecot_login authenticator failed for ([5.77.211.174]) [5.77.211.174]:55456: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.11.230.160
country_id: 2510769
description:
2025-11-18 00:40:57 dovecot_login authenticator failed for 160.red-88-11-230.dynamicip.rima-tde.net [88.11.230.160]:58293: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-11-18 00:40:14 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:49394: 535 Incorrect authentication data (set_id=juridico)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-18 00:40:21 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:44549: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 191.53.129.193
country_id: 3469034
description:
Nov 18 00:40:30 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos>, method=PLAIN, rip=191.53.129.193, lip=200.150.196.245, TLS, session=<Z5WjONZDR92/NYHB>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0QHOOdZD3umxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.76.17
country_id: 2077456
description:
2025-11-18 00:40:48 dovecot_login authenticator failed for ([123.209.76.17]) [123.209.76.17]:53152: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.233.246
country_id: 1835841
description:
2025-11-18 00:40:57 dovecot_login authenticator failed for ([221.149.233.246]) [221.149.233.246]:53353: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 00:41:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<O9F9O9ZDkJlA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.29.192
country_id: 294640
description:
2025-11-18 00:41:31 dovecot_login authenticator failed for ([95.35.29.192]) [95.35.29.192]:42142: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-18 00:41:32 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:44312: 535 Incorrect authentication data (set_id=novamanha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.95
country_id: 6252001
description:
2025-11-18 00:41:49 dovecot_login authenticator failed for ([70.174.168.95]) [70.174.168.95]:58796: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 00:42:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<bZ8nP9ZDaLxns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.198.134.241
country_id: 2017370
description:
2025-11-18 00:41:16 dovecot_login authenticator failed for (host-94.198.134.241.vernet.su) [94.198.134.241]:58372: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.62.42.70
country_id: 1814991
description:
2025-11-18 00:41:18 dovecot_login authenticator failed for ([111.62.42.70]) [111.62.42.70]:42978: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 00:41:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<zVVsPNZD0N+ElIx5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:41:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<y09vPdZDso2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 00:42:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<X5cYP9ZDeNrBl4nP>


plugin: ossec
rule: 5706
name: SSH insecure connection attempt (scan).
abuser: 147.185.133.129
country_id: 6252001
description:
Nov 18 00:42:32 hosting sshd[4679]: Did not receive identification string from 147.185.133.129 port 58952


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XXQBQdZDkqOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.209.18
country_id: 1814991
description:
2025-11-18 00:42:08 dovecot_login authenticator failed for ([220.189.209.18]) [220.189.209.18]:35134: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.64.205.45
country_id: 3017382
description:
2025-11-18 00:42:15 dovecot_login authenticator failed for 82-64-205-45.subs.proxad.net [82.64.205.45]:32497: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-18 00:42:17 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:64198: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2025-11-18 00:42:26 dovecot_login authenticator failed for ([218.22.187.67]) [218.22.187.66]:56322: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 00:42:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<ImKrQNZDwKCB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 00:42:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<lEgQQdZD0LkkMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-18 00:42:55 dovecot_login authenticator failed for ([90.160.139.163]) [90.160.139.163]:52949: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:43:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kovBQtZDHLexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2025-11-18 00:43:11 dovecot_login authenticator failed for ([65.20.179.251]) [65.20.179.251]:49935: 535 Incorrect authentication data (set_id=recepcao)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-11-18 00:43:29 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:62404: 535 Incorrect authentication data (set_id=vendas@arkson.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<u02RRNZDdMOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.57.17.172
country_id: 1814991
description:
2025-11-18 00:43:34 dovecot_login authenticator failed for ([111.57.17.172]) [111.57.17.172]:50412: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 00:43:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<nKuERdZDdrU7GIXF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 18 00:43:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<wIvxRdZDNuWWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 00:44:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<mSdsRtZDIK9xoZB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 18 00:43:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<7SstQ9ZDrrovT1jH>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.23.230.106
country_id: 6252001
description:
[2025-11-18 00:43:14 -0300] info [cpaneld] 66.23.230.106 - projetol "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 00:43:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<spncQ9ZDpsQtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 00:44:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<a1wiRtZDqNUv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-11-18 00:44:01 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:43522: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2025-11-18 00:44:07 dovecot_login authenticator failed for ([211.196.31.2]) [211.196.31.2]:59497: 535 Incorrect authentication data (set_id=vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 00:44:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<72t/R9ZDVreGx8nN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 00:44:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<8Z2hR9ZDor0tPZWl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<K5McSNZDIt2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 00:44:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<0oBRSdZDHJNAF/Qn>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<eGG8S9ZDeu2xV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:46:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7hSDTdZDlo6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2025-11-18 00:46:01 dovecot_login authenticator failed for ([179.184.218.49]) [179.184.218.49]:53834: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 00:46:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=</W7TTtZDAL6kXF7M>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5IdPT9ZDspaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2025-11-18 00:46:39 dovecot_login authenticator failed for ([219.248.4.146]) [219.248.4.146]:59134: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 00:46:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<AQLET9ZD0LBxoZB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 220.246.36.42
country_id: 1819730
description:
Nov 18 00:46:50 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<wesley@toromartelinho.com.br>, method=PLAIN, rip=220.246.36.42, lip=200.150.196.245, session=<fJsaUNZDrOPc9iQq>


plugin: ossec
rule: 5706
name: SSH insecure connection attempt (scan).
abuser: 185.247.137.188
country_id: 2635167
description:
Nov 18 00:47:05 hosting sshd[10791]: Did not receive identification string from 185.247.137.188 port 40479


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Dm7jUtZD/K6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 218.27.205.159
country_id: 1814991
description:
Nov 18 00:47:38 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<wesley>, method=PLAIN, rip=218.27.205.159, lip=200.150.196.245, TLS, session=<hELvUdZDj9XaG82f>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.100.107.238
country_id: 1831722
description:
Nov 18 00:47:14 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<wesley@toromartelinho.com.br>, method=PLAIN, rip=175.100.107.238, lip=200.150.196.245, TLS, session=<xsN6UNZD9sqvZGvu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Nov 18 00:47:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=<nGkqUtZDpIbBHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 00:47:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<JCy6UtZDBI2UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 00:48:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<2okmVdZDKMCd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.218.97
country_id: 1814991
description:
2025-11-18 00:48:28 dovecot_login authenticator failed for ([111.26.218.96]) [111.26.218.97]:41944: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.54.66
country_id: 1643084
description:
[2025-11-18 00:48:53 -0300] info [cpaneld] 157.66.54.66 - hoteljoi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:49:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KGg3WNZD5s2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.77.172.143
country_id: 1668284
description:
2025-11-18 00:48:15 dovecot_login authenticator failed for ([119.77.172.143]) [119.77.172.143]:4507: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<CFV2VtZDiMaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 00:49:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@f5assessoria.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<ai0SWNZDyqJ2wSaf>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2025-11-18 00:49:06 H=(localhost.localdomain) [78.153.140.207]:34948 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 00:49:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<q3EnWdZDwsJo7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<nlYAWtZDuNWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 00:49:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<2xYVW9ZDUM3Bl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 00:50:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<awaQW9ZD9KGP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 00:50:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<b4rAW9ZDksxA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-11-18 00:50:26 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:48368: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<T6OdXdZDcu2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
country_id: 1835841
description:
2025-11-18 00:50:44 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:39212: 535 Incorrect authentication data (set_id=pastorpaulo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 00:50:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<3hXMXtZDKpMnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.202.197
country_id: 3175395
description:
2025-11-18 00:50:57 dovecot_login authenticator failed for host-95-229-202-197.business.telecomitalia.it [95.229.202.197]:51806: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.46.186
country_id: 1269750
description:
2025-11-18 00:51:03 dovecot_login authenticator failed for ([125.21.153.217]) [182.95.46.186]:47456: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.105
country_id: 1814991
description:
2025-11-18 00:50:08 dovecot_login authenticator failed for ([27.24.141.105]) [27.24.141.105]:45386: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 18 00:50:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<xRgDXdZDEKArZDwA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.144
country_id: 1819730
description:
2025-11-18 00:50:29 dovecot_login authenticator failed for (223-197-153-144.static.imsbiz.com) [223.197.153.144]:50895: 535 Incorrect authentication data (set_id=pastorpaulo@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
country_id: 2440476
description:
2025-11-18 00:50:45 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:36865: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.15.132
country_id: 1814991
description:
2025-11-18 00:51:52 dovecot_login authenticator failed for ([222.128.15.132]) [222.128.15.132]:43936: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.222.177.146
country_id: 6252001
description:
2025-11-18 00:51:13 dovecot_login authenticator failed for ([12.222.177.146]) [12.222.177.146]:55790: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 00:51:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<SvF2YNZDnoV9gnHM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RfssYdZDzpexV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:52:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cL3uYtZDAqCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.33
country_id: 1668284
description:
2025-11-18 00:52:01 dovecot_login authenticator failed for 221-120-4-33.emome-ip.hinet.net [221.120.4.33]:58373: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.188
country_id: 3996063
description:
2025-11-18 00:52:04 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:45005: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 18 00:51:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<TKLzX9ZDupoIiXsk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 00:51:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<3tbrYNZD3OR3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 00:52:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<UGDSYtZDWqakXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 00:52:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<0kVJY9ZDZMiYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.83
country_id: 1814991
description:
2025-11-18 00:52:16 dovecot_login authenticator failed for ([36.135.62.83]) [36.135.62.83]:37430: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-11-18 00:52:26 dovecot_login authenticator failed for ([117.247.239.202]) [117.247.239.202]:47346: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 00:52:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<7N4QZdZDqIOKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.119
country_id: 1814991
description:
2025-11-18 00:52:40 dovecot_login authenticator failed for ([111.26.106.119]) [111.26.106.119]:47626: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 00:52:51 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52284: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 00:53:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<a3heZtZDnK0naoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 18 00:52:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<Se1rZNZDuM4v+wDY>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 00:52:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<KDKBZNZDtBJo7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bFnDZNZDjK+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 18 00:52:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<jksHZdZDNhIkMrGr>


plugin: ossec
rule: 5706
name: SSH insecure connection attempt (scan).
abuser: 147.185.133.25
country_id: 6252001
description:
Nov 18 00:52:42 hosting sshd[18962]: Did not receive identification string from 147.185.133.25 port 59986


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-11-18 00:53:09 dovecot_login authenticator failed for (static-ip-1815407040.cable.net.co) [181.54.70.40]:55500: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 00:53:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<Dh1fZ9ZDwp1vAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.50.154
country_id: 1269750
description:
2025-11-18 00:53:29 dovecot_login authenticator failed for ([182.95.50.154]) [182.95.50.154]:40856: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OV9SaNZDfsKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.174
country_id: 1668284
description:
2025-11-18 00:53:44 dovecot_login authenticator failed for 221-120-57-174.emome-ip.hinet.net [221.120.57.174]:47790: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 00:53:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<EfMJadZDMMtCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 00:54:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<z5IlatZDbKcI2Cjk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2025-11-18 00:53:11 dovecot_login authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:46902: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.140.111
country_id: 1819730
description:
2025-11-18 00:54:52 dovecot_login authenticator failed for (m121-202-140-111.smartone.com) [121.202.140.111]:55289: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.177.110
country_id: 1835841
description:
2025-11-18 00:54:59 dovecot_login authenticator failed for ([222.108.177.110]) [222.108.177.110]:41710: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 00:54:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<n9usatZDSs9AF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.171.125
country_id: 1562822
description:
2025-11-18 00:54:20 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [113.160.171.125]:36181: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DTfla9ZDytqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.253.154
country_id: 1269750
description:
2025-11-18 00:54:32 dovecot_login authenticator failed for ([125.21.56.137]) [125.19.253.154]:56520: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.137.75.227
country_id: 3017382
description:
2025-11-18 00:54:32 dovecot_login authenticator failed for (4-229-254-46.reverse.alphalink.fr) [185.137.75.227]:58870: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:55:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<B9qrbdZD1uOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 00:54:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<s7VtatZD3IDBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2025-11-18 00:54:13 dovecot_login authenticator failed for ool-6038e495.static.optonline.net [96.56.228.149]:56844: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 00:54:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<Z3fQatZDtNp3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 00:54:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<0thPa9ZDVOKYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.16.40.3
country_id: 1814991
description:
2025-11-18 00:55:32 dovecot_login authenticator failed for ([110.16.40.3]) [110.16.40.3]:1820: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.253.122
country_id: 1814991
description:
2025-11-18 00:55:41 dovecot_login authenticator failed for ([112.25.253.122]) [112.25.253.122]:42804: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.92.235.70
country_id: 1210997
description:
2025-11-18 00:55:09 dovecot_login authenticator failed for ([180.92.235.70]) [180.92.235.70]:42312: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.85
country_id: 1814991
description:
2025-11-18 00:55:28 dovecot_login authenticator failed for ([111.26.63.85]) [111.26.63.85]:33550: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.82.40.34
country_id: 1694008
description:
2025-11-18 00:55:59 dovecot_login authenticator failed for ([203.82.40.34]) [203.82.40.34]:58338: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.171.27.248
country_id: 1814991
description:
2025-11-18 00:56:02 dovecot_login authenticator failed for ([116.171.27.248]) [116.171.27.248]:39760: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.254.228.161
country_id: 2017370
description:
2025-11-18 00:55:10 dovecot_login authenticator failed for line161-37.adsl.kirov.ru [89.254.228.161]:53769: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.112
country_id: 1814991
description:
2025-11-18 00:55:28 dovecot_login authenticator failed for ([27.24.141.112]) [27.24.141.112]:49508: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DcF4b9ZDIoWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-18 00:55:37 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:57020: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.67.82
country_id: 3469034
description:
2025-11-18 00:55:11 dovecot_login authenticator failed for ([200.195.67.82]) [200.195.67.82]:41304: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 00:55:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<yMYib9ZDYtsI1et7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.145.6
country_id: 3865483
description:
2025-11-18 00:55:44 dovecot_login authenticator failed for ([143.202.145.6]) [143.202.145.6]:35456: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.204.31
country_id: 1814991
description:
2025-11-18 00:55:48 dovecot_login authenticator failed for ([220.180.204.31]) [220.180.204.31]:53518: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 00:56:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<HnL+cdZDlMp9gnHM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 00:57:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<EGajdNZDpOCd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-11-18 00:56:10 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:44420: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.78
country_id: 6252001
description:
2025-11-18 00:56:23 dovecot_login authenticator failed for ([74.196.184.78]) [74.196.184.78]:38442: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 18 00:56:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<LNM1c9ZDXpOdQi/y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 18 00:56:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=<jWFgc9ZDEpuqQMFo>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.233.92.123
country_id: 1269750
description:
2025-11-18 00:56:57 dovecot_login authenticator failed for ([103.233.92.123]) [103.233.92.123]:55498: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-18 00:56:26 dovecot_login authenticator failed for (nsg-corporate-126.176.185.122.airtel.in) [122.185.176.126]:36390: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<i1ERc9ZDpJ2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 00:57:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<7TqxdNZDgr9SnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.109.110
country_id: 3865483
description:
Nov 18 00:56:12 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas>, method=PLAIN, rip=190.181.109.110, lip=200.150.196.245, TLS, session=<QnTQcNZDvYu+tW1u>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.117.131
country_id: 3144096
description:
2025-11-18 00:56:14 dovecot_login authenticator failed for (cm-46.212.117.131.get.no) [46.212.117.131]:41961: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.112.237
country_id: 2328926
description:
2025-11-18 00:56:40 dovecot_login authenticator failed for ([196.200.112.237]) [196.200.112.237]:3077: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 00:56:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<hwhodNZDvuCl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.234
country_id: 2186224
description:
2025-11-18 00:56:59 dovecot_login authenticator failed for ([121.73.168.234]) [121.73.168.234]:50726: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:58:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IF9ueNZDdsCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.139
country_id: 1835841
description:
2025-11-18 00:57:08 dovecot_login authenticator failed for ([121.131.220.139]) [121.131.220.139]:59762: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.199.168
country_id: 1562822
description:
2025-11-18 00:57:19 dovecot_login authenticator failed for ([171.244.199.168]) [171.244.199.168]:59722: 535 Incorrect authentication data (set_id=salamuni)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 115.231.78.11
country_id: 1814991
description:
Nov 18 00:57:25 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 116 secs): user=<>, rip=115.231.78.11, lip=200.150.196.245, session=<Z9kvdtZDMHVz504L>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-11-18 00:57:30 dovecot_login authenticator failed for ([65.20.174.63]) [65.20.174.63]:38300: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2X6hdtZDhLGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 00:57:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<HxVHd9ZDfvWKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.166
country_id: 1269750
description:
2025-11-18 00:58:07 dovecot_login authenticator failed for ([182.95.131.41]) [103.251.31.166]:36144: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 00:58:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<GeHqetZD4Nxns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.22.241.32
country_id: 1668284
description:
2025-11-18 00:58:47 dovecot_login authenticator failed for 223-22-241-32.mobile.dynamic.aptg.com.tw [223.22.241.32]:51575: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 00:58:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<UZmQe9ZDQIormxBp>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 186.224.121.147
country_id: 3469034
description:
Nov 18 00:58:59 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos>, method=PLAIN, rip=186.224.121.147, lip=200.150.196.245, TLS, session=<n+fOetZDg8q64HmT>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.172
country_id: 1668284
description:
2025-11-18 00:58:25 dovecot_login authenticator failed for (58-115-53-172.twt1.com.tw) [58.115.53.172]:43654: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.242.74
country_id: 1269750
description:
2025-11-18 00:58:22 dovecot_login authenticator failed for ([128.185.96.217]) [128.185.242.74]:44256: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 00:58:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<IczPedZDNNdvAEul>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZUYyetZD6sixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 18 00:58:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<G/tJe9ZD0s0zTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 00:59:00 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50611: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.57.17.172
country_id: 1814991
description:
2025-11-18 00:59:02 dovecot_login authenticator failed for ([111.57.17.172]) [111.57.17.172]:50694: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 00:58:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@oabsjp.org.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<pi0SedZDGtx2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 00:59:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<AdZhfdZDyptn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 00:59:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=</qqpfdZDrqGP9IUv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 00:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PGfIfdZD0uCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.150.69
country_id: 6251999
description:
2025-11-18 01:00:47 dovecot_login authenticator failed for ([38.20.150.69]) [38.20.150.69]:56463: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 01:00:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<mpWUgtZDNsKElIx5>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:01:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gaIfg9ZDCpKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 01:00:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<Cgq/f9ZDDqaB4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 01:00:16 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51881: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</cFdgdZDQIqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.244.6.94
country_id: 2017370
description:
2025-11-18 01:00:35 dovecot_login authenticator failed for (ws6-94.maryno.net) [188.244.6.94]:55350: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.69.234.21
country_id: 1814991
description:
2025-11-18 01:01:42 dovecot_login authenticator failed for (dns58.online.tj.cn) [218.69.234.21]:41141: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.22
country_id: 1269750
description:
2025-11-18 01:01:52 dovecot_login authenticator failed for ([182.95.22.249]) [128.185.194.22]:59522: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-18 01:01:37 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:56540: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-11-18 01:01:56 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:42452: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.217.188
country_id: 690791
description:
2025-11-18 01:02:01 dovecot_login authenticator failed for ip-d9bc.d-net.kiev.ua [94.154.217.188]:58806: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2025-11-18 01:02:06 dovecot_login authenticator failed for ([203.252.10.4]) [203.252.10.4]:52614: 535 Incorrect authentication data (set_id=juridico)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 01:01:09 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:63525: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.155.199.176
country_id: 3469034
description:
Nov 18 01:01:21 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=<vAxMhNZDCvOxm8ew>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.133
country_id: 3996063
description:
2025-11-18 01:01:31 dovecot_login authenticator failed for (201.173.216.133-clientes-izzi.mx) [201.173.216.133]:55237: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<H/TxhNZDGpuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.122.211.212
country_id: 1814991
description:
2025-11-18 01:02:44 dovecot_login authenticator failed for (drogariasbigfarma.com.br) [111.122.211.212]:37592: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 01:02:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=</IANidZD/teGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2025-11-18 01:03:00 dovecot_login authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:59063: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3gCGiNZDArWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 01:02:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<+BWhiNZD7tgXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 18 01:02:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<wioCidZD7smiAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
country_id: 1814991
description:
2025-11-18 01:02:43 dovecot_login authenticator failed for ([27.223.98.117]) [27.223.98.117]:56335: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.76.73.4
country_id: 1814991
description:
2025-11-18 01:02:14 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:27722: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-11-18 01:02:26 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:58156: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 01:03:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<xcOlitZDSLhCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.122.211.212
country_id: 1814991
description:
2025-11-18 01:03:10 dovecot_login authenticator failed for (drogariasbigfarma.com.br) [111.122.211.212]:42216: 535 Incorrect authentication data (set_id=admin@drogariasbigfarma.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 01:03:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<cKAZjdZD8LJw2eny>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:04:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7zvejdZDstWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.143.79
country_id: 3865483
description:
2025-11-18 01:03:12 dovecot_login authenticator failed for host-cotesma-114-143-79.smandes.com.ar [181.114.143.79]:33373: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 01:03:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<ME3Ei9ZDoIwv7PP+>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:03:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Te0djNZDAs6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.135.236.154
country_id: 2017370
description:
2025-11-18 01:03:34 dovecot_login authenticator failed for ([79.135.236.154]) [79.135.236.154]:51206: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.248.31
country_id: 1835841
description:
2025-11-18 01:04:36 dovecot_login authenticator failed for ([121.188.248.31]) [121.188.248.31]:34562: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 18 01:04:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<dD3aj9ZDppx57bKF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 01:04:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<5/4TkNZD3Jdns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 01:04:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<n8O2kNZDOOVSczCz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 01:04:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<kFPRkNZD9LWvfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 01:04:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<9RzskNZDMsuB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.121.234.5
country_id: 1814991
description:
2025-11-18 01:04:20 dovecot_login authenticator failed for ([118.121.234.5]) [118.121.234.5]:48324: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6t2pj9ZDduOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 01:04:52 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:52075: 535 Incorrect authentication data (set_id=test@jacgeneralcleaning.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 01:06:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<ZZDilNZDCNTSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 01:05:14 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:62604: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 01:05:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<EcJYktZDtLml0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
country_id: 1814991
description:
2025-11-18 01:05:30 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:35823: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:05:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<k1BEk9ZDmoexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.185.14
country_id: 3469034
description:
2025-11-18 01:05:52 dovecot_login authenticator failed for ([189.113.185.14]) [189.113.185.14]:41320: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:07:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<snaZmNZD/KixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 01:06:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<Amo7ldZD8oYtPZWl>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.220.174.45
country_id: 3469034
description:
[2025-11-18 01:06:10 -0300] info [webmaild] 177.220.174.45 - anderson@implementarconsultoria.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.114.111
country_id: 1880251
description:
2025-11-18 01:06:27 dovecot_login authenticator failed for ([124.246.114.111]) [124.246.114.111]:53071: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TunKltZDOqCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 01:06:46 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52143: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.83
country_id: 1814991
description:
2025-11-18 01:06:47 dovecot_login authenticator failed for ([36.135.62.82]) [36.135.62.83]:33748: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 01:06:50 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55507: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 01:07:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<vAQOm9ZDApWUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 01:08:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<KhhBnNZDwtJns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 01:07:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<r9DImdZDvINn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 01:07:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<fFztmdZDNshA44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Ez1fmtZDALmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 01:07:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<Rm88mtZDNr8kMrBu>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yS/9ndZDpM2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 01:08:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<aS1xn9ZD4cR3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.8.114
country_id: 2017370
description:
2025-11-18 01:08:09 dovecot_login authenticator failed for ([213.234.8.114]) [213.234.8.114]:50270: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 01:08:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<0L8lndZDcOlrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.148.184.47
country_id: 1835841
description:
2025-11-18 01:09:52 dovecot_login authenticator failed for ([121.148.184.47]) [121.148.184.47]:59279: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:10:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<U2xOo9ZDEoKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.199.168
country_id: 1562822
description:
2025-11-18 01:10:02 dovecot_login authenticator failed for ([171.244.199.168]) [171.244.199.168]:5163: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 01:09:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<HwJ0oNZDIsRCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.177.110
country_id: 1835841
description:
2025-11-18 01:09:26 dovecot_login authenticator failed for ([222.108.177.110]) [222.108.177.110]:47265: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<naeOodZDIOGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.51.252.26
country_id: 1814991
description:
2025-11-18 01:09:43 dovecot_login authenticator failed for ([122.139.16.200]) [119.51.252.26]:48400: 535 Incorrect authentication data


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<oUYYpdZDrIqxV3kv>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.104
country_id: 3469034
description:
2025-11-18 01:10:39 H=(localhost) [179.0.178.104]:60873 F=<postmaster@mail.com> rejected RCPT <sec@assembleiadedeuspiraquara.com.br>: Unrouteable address


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2025-11-18 01:11:02 dovecot_login authenticator failed for 27-124-111-122.static.as58511.net [27.124.111.122]:52068: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-11-18 01:11:06 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:43778: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.169.78.196
country_id: 2017370
description:
2025-11-18 01:10:18 dovecot_login authenticator failed for ([178.169.78.196]) [178.169.78.196]:58570: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 01:10:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<pIh0pNZDgrTSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.99
country_id: 1269750
description:
2025-11-18 01:10:48 dovecot_login authenticator failed for ([103.190.91.99]) [103.190.91.99]:37308: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 01:10:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<pL1FptZDnL4O4dKR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 01:11:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<RnFBqdZDGLyl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.40.20
country_id: 2017370
description:
2025-11-18 01:11:54 dovecot_login authenticator failed for broadband-37-110-40-20.ip.moscow.rt.ru [37.110.40.20]:58328: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.82.116.176
country_id: 1814991
description:
2025-11-18 01:11:28 dovecot_login authenticator failed for ([223.82.116.176]) [223.82.116.176]:1168: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.216.24.21
country_id: 6290252
description:
2025-11-18 01:11:38 dovecot_login authenticator failed for cable-89-216-24-21.static.sbb.rs [89.216.24.21]:59018: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.106.102
country_id: 6252001
description:
2025-11-18 01:11:41 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:50305: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-11-18 01:11:45 dovecot_login authenticator failed for ([77.211.31.222]) [77.211.31.222]:53965: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.155.199.176
country_id: 3469034
description:
Nov 18 01:11:47 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.155.199.176, lip=200.150.196.245, TLS, session=<pkaPqdZDIOSxm8ew>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.138.108.57
country_id: 6252001
description:
2025-11-18 01:12:05 dovecot_login authenticator failed for (syn-075-138-108-057.res.spectrum.com) [75.138.108.57]:52214: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:11:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hIu5qNZDUqGxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:13:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RcAQrtZDqsCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-11-18 01:12:08 dovecot_login authenticator failed for ([14.99.61.248]) [14.99.61.248]:41954: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 01:12:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<A8zmqtZD5to+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-18 01:12:10 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:41626: 535 Incorrect authentication data (set_id=cpanel)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 01:12:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<1DD6qtZDMomB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 01:12:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<tQQ1rNZD3Oxn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-11-18 01:12:23 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:46040: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<x6dLrNZDULSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 01:12:37 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52423: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 01:12:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<FjLtrNZDIK6UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.70.204.63
country_id: 3175395
description:
Nov 18 01:12:46 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<novidadevida>, method=PLAIN, rip=109.70.204.63, lip=200.150.196.245, TLS, session=<GjILrNZDAKZtRsw/>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.138.90.104
country_id: 1814991
description:
2025-11-18 01:13:42 dovecot_login authenticator failed for ([219.138.90.104]) [219.138.90.104]:46517: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.218.214.16
country_id: 1814991
description:
2025-11-18 01:13:53 dovecot_login authenticator failed for ([113.218.214.16]) [113.218.214.16]:46974: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.224
country_id: 1668284
description:
2025-11-18 01:13:53 dovecot_login authenticator failed for 110-25-105-224.adsl.fetnet.net [110.25.105.224]:43304: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<o8/Sr9ZDhsixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.4.36
country_id: 1269750
description:
2025-11-18 01:13:34 dovecot_login authenticator failed for (cityzone-36-4-59-103.cityzoneinfo.com) [103.59.4.36]:44778: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.18.200.242
country_id: 6252001
description:
2025-11-18 01:14:07 dovecot_login authenticator failed for ool-2f12c8f2.dyn.optonline.net [47.18.200.242]:39982: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 01:14:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<3wtms9ZDJLgtPZWl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<smBxs9ZDquCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2025-11-18 01:14:38 dovecot_login authenticator failed for ([90.173.78.90]) [90.173.78.90]:50250: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.244.34
country_id: 1269750
description:
2025-11-18 01:14:39 dovecot_login authenticator failed for (nsg-corporate-34.244.186.122.airtel.in) [122.186.244.34]:43062: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.203.9.130
country_id: 2077456
description:
2025-11-18 01:14:12 dovecot_login authenticator failed for 14-203-9-130.tpgi.com.au [14.203.9.130]:55620: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 01:14:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<t4FOs9ZDwswrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.97.246
country_id: 1814991
description:
2025-11-18 01:14:55 dovecot_login authenticator failed for ([117.32.97.246]) [117.32.97.246]:43382: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.40.54
country_id: 2510769
description:
2025-11-18 01:15:57 dovecot_login authenticator failed for (cli-5b7e2836.wholesale.adamo.es) [91.126.40.54]:40855: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:16:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<//DKuNZDnJKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-11-18 01:15:07 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:57580: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-11-18 01:15:23 dovecot_login authenticator failed for ([125.17.48.129]) [152.52.210.118]:60976: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<42T7ttZDJoqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 01:15:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<GBzqt9ZDCNcv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.31.138.38
country_id: 3469034
description:
2025-11-18 01:16:16 dovecot_plain authenticator failed for 189-31-138-38.user3p.v-tal.net.br ([192.168.56.1]) [189.31.138.38]:54622: 535 Incorrect authentication data (set_id=rodrigo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 01:16:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<7eryutZDbs1rhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-11-18 01:16:43 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:36324: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2025-11-18 01:16:57 dovecot_login authenticator failed for ([111.26.63.86]) [111.26.63.87]:55400: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-11-18 01:16:09 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:33589: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:16:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ISCcutZDtpyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 01:16:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<wrjxutZD7IWYNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 01:16:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<Dcxqu9ZDerlSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
country_id: 3144096
description:
2025-11-18 01:17:07 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:47938: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.181.191.152
country_id: 2017370
description:
2025-11-18 01:17:17 dovecot_login authenticator failed for (94x181x191x152.static-business.penza.ertelecom.ru) [94.181.191.152]:58214: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.198.120
country_id: 1814991
description:
2025-11-18 01:17:17 dovecot_login authenticator failed for ([183.167.198.120]) [183.167.198.120]:56875: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 01:17:19 dovecot_login authenticator failed for (User) [177.74.174.120]:58182: 535 Incorrect authentication data (set_id=alves@inovasite.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IMssvtZD1LOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-18 01:17:41 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:46772: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:19:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6wuJw9ZD7tOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.145
country_id: 1668284
description:
2025-11-18 01:18:07 dovecot_login authenticator failed for 110-25-112-145.adsl.fetnet.net [110.25.112.145]:53306: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.243.78
country_id: 1269750
description:
2025-11-18 01:18:23 dovecot_login authenticator failed for (nsg-corporate-78.243.186.122.airtel.in) [122.186.243.78]:35484: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IKO8wdZDusuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 18 01:18:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<j03UwdZDtppbejg7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 18 01:18:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=</LjzwdZDMoArZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 18 01:19:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<6GZixNZD4KKnR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 01:19:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<EbovxdZDZ4N3xBIC>


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 193.138.218.203
country_id: 2661886
description:
Nov 18 01:19:55 hosting pure-ftpd: (?@193.138.218.203) [WARNING] Authentication failed for user [OIxlhfZ8<]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:20:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<t60ex9ZDIOyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.134.242.169
country_id: 1814991
description:
2025-11-18 01:19:08 dovecot_login authenticator failed for ([222.134.242.169]) [222.134.242.169]:51632: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 01:19:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<TD3pxNZDuKaElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.170.146.177
country_id: 1814991
description:
2025-11-18 01:19:29 dovecot_login authenticator failed for ([111.170.146.177]) [111.170.146.177]:40264: 535 Incorrect authentication data (set_id=secretarioadjunto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 01:19:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@f5assessoria.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<+OIaxtZDItekXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 01:19:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<njNzxtZDqpil0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 01:20:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<HT4tyNZD+IxA44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BQvfyNZD1oWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 01:20:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<WWC7yNZDNPKvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.64.209.11
country_id: 1814991
description:
2025-11-18 01:20:44 dovecot_login authenticator failed for (11.209.64.125.broad.dy.sc.dynamic.163data.com.cn) [125.64.209.11]:39279: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2025-11-18 01:21:00 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:47452: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.193.140.76
country_id: 6252001
description:
2025-11-18 01:21:50 dovecot_login authenticator failed for ([71.193.140.76]) [71.193.140.76]:44222: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.59.146.164
country_id: 3469034
description:
2025-11-18 01:21:59 dovecot_login authenticator failed for (sp-138-59-146-164.l3.eveocloud.net) [138.59.146.164]:41832: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 18 01:21:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<JSnhytZDFS2317Oa>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TsZxzNZDmJ2xV3kv>


plugin: ossec
rule: 5706
name: SSH insecure connection attempt (scan).
abuser: 162.216.150.72
country_id: 6252001
description:
Nov 18 01:21:45 hosting sshd[24097]: Did not receive identification string from 162.216.150.72 port 59498


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:22:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<N+RBztZDBKmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 01:22:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<4rBYztZDGIRns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2025-11-18 01:21:32 dovecot_login authenticator failed for ([182.95.22.208]) [125.23.228.86]:56518: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 01:21:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<vKTWzNZDjOgv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 01:21:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pousadarincaoalegre.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<DgHczNZDxrVzR+4E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 01:22:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@highqualityautoparts.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<g+Aez9ZDFKc+PIOL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HIgD0NZD5rSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 01:22:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@primiciapersianas.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<JL590NZD7td2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.202.61.155
country_id: 2017370
description:
2025-11-18 01:22:47 dovecot_login authenticator failed for 155-61-202-109.kamensktel.ru [109.202.61.155]:37842: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 01:22:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@primiciapersianas.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<NRbl0NZD5takXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 01:22:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<KTBg0dZD7sxAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.134.120
country_id: 1269750
description:
2025-11-18 01:23:00 dovecot_login authenticator failed for (abts-mum-static-120.134.179.122.airtelbroadband.in) [122.179.134.120]:47752: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.75.106.225
country_id: 290557
description:
2025-11-18 01:23:03 dovecot_login authenticator failed for ([91.75.106.225]) [91.75.106.225]:50968: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 01:22:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<utJfztZDIs2B4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 01:22:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<nHcs0dZDusBSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.107.57
country_id: 1814991
description:
2025-11-18 01:23:33 dovecot_login authenticator failed for ([36.135.107.57]) [36.135.107.57]:59978: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 01:23:34 dovecot_login authenticator failed for (User) [177.74.174.120]:60729: 535 Incorrect authentication data (set_id=alves@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 01:23:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<LE/G1NZDAreGx8nN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 200.141.211.58
country_id: 3469034
description:
Nov 18 01:23:55 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<fernandabrum@prafebrum.com.br>, method=PLAIN, rip=200.141.211.58, lip=200.150.196.245, TLS, session=<Mlbl09ZD4uHIjdM6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 01:23:31 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51834: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JQea09ZD0suxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 01:24:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<iQuJ19ZDlK2kXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 01:24:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<3ACQ19ZD6pk7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.140.134
country_id: 1562822
description:
2025-11-18 01:24:47 dovecot_login authenticator failed for ([171.244.140.134]) [171.244.140.134]:23190: 535 Incorrect authentication data (set_id=coordenacao@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 211.223.41.90
country_id: 1835841
description:
Nov 18 01:24:47 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<fernandabrum>, method=PLAIN, rip=211.223.41.90, lip=200.150.196.245, TLS, session=<y4zC1tZDetPT3yla>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 01:24:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<nSqu1tZD7vRxoZB3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:24:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<r9A319ZD8tuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 18 01:24:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<4po819ZDnNaWXx+e>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 01:24:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fernandotonet.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<zJ1Z19ZDbK6kXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 01:24:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<dpcH2NZDnMUtPZWl>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:25:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zKX52NZDvuqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.81.180
country_id: 2017370
description:
2025-11-18 01:25:09 dovecot_login authenticator failed for (95-165-81-180.dynamic.spd-mgts.ru) [95.165.81.180]:61359: 535 Incorrect authentication data (set_id=coordenacao)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 01:25:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<6sxe2tZDzOWd5hjP>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QZjI2tZDoISxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 01:25:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<JIST29ZDXMMkMrBu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 01:25:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<ITzU29ZDbtEtPZWl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OHpW3tZDOJuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 01:26:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<PVRH3tZDPNlo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 01:27:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<dPgp4NZDuPhxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
country_id: 2017370
description:
2025-11-18 01:27:41 dovecot_login authenticator failed for ([178.178.194.137]) [178.178.194.137]:56406: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 01:27:45 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52245: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.61.244
country_id: 1814991
description:
2025-11-18 01:27:57 dovecot_login authenticator failed for ([111.26.61.244]) [111.26.61.244]:41202: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:28:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NjC649ZDCrqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 01:27:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<ikcB4dZDZJ3Bl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 01:27:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<6Pmu4dZDnOkXXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IkHr4dZDiLCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-11-18 01:27:49 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:56995: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.68.179.38
country_id: 3175395
description:
Nov 18 01:28:07 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<jesse@pousadarincaoalegre.com.br>, method=PLAIN, rip=185.68.179.38, lip=200.150.196.245, TLS, session=<rl/l4tZDYeS5RLMm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2025-11-18 01:28:16 dovecot_login authenticator failed for ([184.151.88.27]) [184.151.88.27]:42429: 535 Incorrect authentication data (set_id=recepcao)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-11-18 01:28:29 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:35598: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:28:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<e7+F5dZD6MGxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<z9gW6dZDcNmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 01:29:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<45ZT6tZDqpWKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.144.52.234
country_id: 660013
description:
2025-11-18 01:30:01 dovecot_plain authenticator failed for (wd0ea9bcl7ydd6meaei95d4m4akonv) [45.144.52.234]:29082: 535 Incorrect authentication data (set_id=mariacecilia@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2025-11-18 01:30:04 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:42572: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 01:29:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<cMlS6dZD1J2UcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
country_id: 1269750
description:
2025-11-18 01:29:58 dovecot_login authenticator failed for ([203.193.137.250]) [203.193.137.250]:59931: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 01:29:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<5dmG59ZDjpGP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 18 01:29:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@huboperacoes.com>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<pkLi59ZDJLwrZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 01:29:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<nuqD6NZD3IBA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.79.237
country_id: 2017370
description:
2025-11-18 01:29:10 dovecot_login authenticator failed for broadband-188-32-79-237.ip.moscow.rt.ru [188.32.79.237]:36442: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.123
country_id: 1819730
description:
2025-11-18 01:29:38 dovecot_login authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:49313: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 01:29:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<oAWd6dZDJDto7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 01:29:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@betmetalurgica.com.br>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<xkCT6dZD1IuYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.135.6.10
country_id: 1814991
description:
2025-11-18 01:29:51 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:34857: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2025-11-18 01:30:07 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:45670: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 01:30:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<2s+p69ZDqJukXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.0.216
country_id: 6252001
description:
Nov 18 01:30:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=47.251.0.216, lip=200.150.196.245, session=<QmdQ7NZDjJMv+wDY>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+YCl7NZDQoOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.61.176.110
country_id: 3469034
description:
2025-11-18 01:30:20 dovecot_login authenticator failed for (177-61-176-110.dsl.telesp.net.br) [177.61.176.110]:52208: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.105.50
country_id: 1814991
description:
2025-11-18 01:30:32 dovecot_login authenticator failed for ([219.129.105.50]) [219.129.105.50]:34972: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 01:30:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<Qowm7dZD8I59gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.243.78
country_id: 1269750
description:
2025-11-18 01:30:50 dovecot_login authenticator failed for (nsg-corporate-78.243.186.122.airtel.in) [122.186.243.78]:54472: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:31:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hVF17tZDgouxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.192
country_id: 6252001
description:
2025-11-18 01:31:09 dovecot_login authenticator failed for ([208.69.161.192]) [208.69.161.192]:59078: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 01:31:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@alcantaraemonteiro.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<OqSE79ZD8sF2wSaf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ne088NZDUJexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.25.58.19
country_id: 1643084
description:
2025-11-18 01:31:48 dovecot_login authenticator failed for ([160.25.58.19]) [160.25.58.19]:54022: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 01:31:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<DYQ38dZDBI4naoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 01:31:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<3rCH8dZDOpiYNbyQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.211.102
country_id: 1269750
description:
2025-11-18 01:32:04 dovecot_login authenticator failed for ([128.185.211.102]) [128.185.211.102]:56594: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.198.134.241
country_id: 2017370
description:
2025-11-18 01:31:29 dovecot_login authenticator failed for (host-94.198.134.241.vernet.su) [94.198.134.241]:58386: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.46.148.174
country_id: 2017370
description:
2025-11-18 01:31:31 dovecot_login authenticator failed for ([178.46.148.174]) [178.46.148.174]:45376: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.215.154
country_id: 2017370
description:
2025-11-18 01:31:43 dovecot_login authenticator failed for ([109.233.215.154]) [109.233.215.154]:57806: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.160.175
country_id: 2661886
description:
2025-11-18 01:31:49 dovecot_login authenticator failed for 37-46-160-175.customers.ownit.se [37.46.160.175]:47734: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 01:31:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<CM4r8dZDJYB3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-11-18 01:32:44 dovecot_login authenticator failed for ([186.239.246.25]) [187.93.2.86]:40285: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.253.122
country_id: 1814991
description:
2025-11-18 01:33:01 dovecot_login authenticator failed for ([112.25.253.122]) [112.25.253.122]:60086: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.138.178
country_id: 1814991
description:
2025-11-18 01:32:09 dovecot_login authenticator failed for ([39.152.138.179]) [39.152.138.178]:46614: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 01:32:28 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:63140: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.8.241.171
country_id: 2077456
description:
2025-11-18 01:32:46 dovecot_login authenticator failed for ([161.8.241.171]) [161.8.241.171]:38706: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.214.110
country_id: 3703430
description:
2025-11-18 01:32:55 dovecot_login authenticator failed for ([200.46.214.104]) [200.46.214.110]:33888: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.33.86
country_id: 3469034
description:
2025-11-18 01:32:58 dovecot_login authenticator failed for 179.184.33.86.static.gvt.net.br [179.184.33.86]:57017: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.243.179.116
country_id: 2017370
description:
2025-11-18 01:32:23 dovecot_login authenticator failed for (46.243.179.116.leadertelecom.ru) [46.243.179.116]:42070: 535 Incorrect authentication data


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<t3nS89ZDfKuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-18 01:32:43 dovecot_login authenticator failed for ([125.20.249.39]) [128.185.214.78]:39836: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.246.241.234
country_id: 1814991
description:
2025-11-18 01:32:54 dovecot_login authenticator failed for ([210.22.130.22]) [58.246.241.234]:54235: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 01:32:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<tnzF8tZDuqRAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.104.175
country_id: 2017370
description:
2025-11-18 01:32:19 dovecot_login authenticator failed for broadband-188-32-104-175.ip.moscow.rt.ru [188.32.104.175]:59958: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.3.246
country_id: 3017382
description:
2025-11-18 01:32:56 dovecot_login authenticator failed for ([188.231.3.246]) [188.231.3.246]:43299: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.141
country_id: 1835841
description:
2025-11-18 01:32:57 dovecot_login authenticator failed for ([121.131.220.141]) [121.131.220.141]:46601: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2025-11-18 01:33:42 dovecot_login authenticator failed for ([65.20.205.197]) [65.20.205.197]:44130: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 01:33:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<sHmz+NZDbsUnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2025-11-18 01:33:19 dovecot_login authenticator failed for ([128.185.187.2]) [128.185.187.2]:57726: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.62
country_id: 1814991
description:
2025-11-18 01:33:27 dovecot_login authenticator failed for ([125.90.72.62]) [125.90.72.62]:47024: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 01:33:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<TNcR99ZDouJCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.100.124.153
country_id: 2017370
description:
2025-11-18 01:33:29 dovecot_login authenticator failed for ([176.100.124.153]) [176.100.124.153]:51536: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.92.235.70
country_id: 1210997
description:
2025-11-18 01:33:30 dovecot_login authenticator failed for ([180.92.235.70]) [180.92.235.70]:43496: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xO5g99ZDDsOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 01:33:17 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64535: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 18 01:33:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<bHyC99ZDcvMkMrGr>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.97
country_id: 6252001
description:
2025-11-18 01:33:44 dovecot_login authenticator failed for ([70.174.168.97]) [70.174.168.97]:49094: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:34:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<a+Iu+dZDJMuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.39.128.68
country_id: 1814991
description:
2025-11-18 01:33:14 dovecot_login authenticator failed for ([27.39.128.68]) [27.39.128.68]:43508: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 01:33:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<J6Lh9dZDdOwI2Cjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 18 01:33:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<6wyZ+NZDtu0IiXsk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 01:34:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<3Sv++NZDkN9vAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.130.35.29
country_id: 2017370
description:
2025-11-18 01:34:23 dovecot_login authenticator failed for ([31.130.35.29]) [31.130.35.29]:58545: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Zk7y+tZDaNqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-11-18 01:34:56 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:47710: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 01:35:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=</u/P/NZDshmKxX03>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.12.106.119
country_id: 1814991
description:
2025-11-18 01:35:07 dovecot_login authenticator failed for ([60.12.106.119]) [60.12.106.119]:40412: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-11-18 01:34:10 dovecot_login authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:52537: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 01:34:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<o2b3+dZDWMSd5hjP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 01:34:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<8mct+9ZDTeR3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2025-11-18 01:35:04 dovecot_login authenticator failed for ([175.203.199.118]) [175.203.199.118]:8150: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.16.91
country_id: 1880251
description:
2025-11-18 01:35:29 dovecot_login authenticator failed for (91.16.156.202.starhub.net.sg) [202.156.16.91]:37153: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 01:35:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<077D/tZDDtR9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.213.54.202
country_id: 3573591
description:
2025-11-18 01:35:41 dovecot_login authenticator failed for ([190.213.54.202]) [190.213.54.202]:48753: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.0.126.86
country_id: 1814991
description:
2025-11-18 01:35:52 dovecot_login authenticator failed for ([111.0.126.86]) [111.0.126.86]:44886: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.172.182
country_id: 3469034
description:
2025-11-18 01:35:25 dovecot_login authenticator failed for (066249.telemar.net.br) [200.216.172.182]:34843: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.192.166
country_id: 1269750
description:
2025-11-18 01:35:28 dovecot_login authenticator failed for ([27.123.105.234]) [128.185.192.166]:47412: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1gSJ/tZD/OuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 01:35:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<D9yE/tZDLOfBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2025-11-18 01:36:01 dovecot_login authenticator failed for ([177.174.95.245]) [177.174.95.245]:45102: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.234.121.57
country_id: 2661886
description:
2025-11-18 01:36:32 dovecot_login authenticator failed for 81-234-121-57-no600.tbcn.telia.com [81.234.121.57]:58852: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qoEWAtdDMpOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.174.216
country_id: 2017370
description:
2025-11-18 01:36:21 dovecot_login authenticator failed for ([46.163.174.216]) [46.163.174.216]:34670: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2025-11-18 01:36:27 dovecot_login authenticator failed for ([1.30.20.98]) [1.30.20.98]:48374: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.71.106.102
country_id: 6252001
description:
2025-11-18 01:36:41 dovecot_login authenticator failed for 198-71-106-198-71-106-102.cpe.sparklight.net [198.71.106.102]:52096: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 18 01:36:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<6yq5AtdD1M0zTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-11-18 01:36:57 dovecot_login authenticator failed for ([182.95.24.209]) [182.95.57.158]:52538: 535 Incorrect authentication data (set_id=bruno)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.98.235.34
country_id: 1814991
description:
2025-11-18 01:36:57 dovecot_login authenticator failed for ([114.98.235.34]) [114.98.235.34]:49176: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.148.10.124
country_id: 1210997
description:
2025-11-18 01:36:14 dovecot_login authenticator failed for ([180.148.10.66]) [180.148.10.124]:36370: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:37:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<b3XlA9dDUKKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 01:37:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<UHJyBtdDiN8rmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 01:37:57 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51604: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2025-11-18 01:37:10 dovecot_login authenticator failed for ([128.185.160.185]) [128.185.235.110]:36800: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HRi0BddD0KyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.191.219
country_id: 1821275
description:
2025-11-18 01:37:32 dovecot_login authenticator failed for nz191l219.bb18094.ctm.net [180.94.191.219]:40162: 535 Incorrect authentication data (set_id=sac@compensadosparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-11-18 01:37:56 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:35146: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.211.111.149
country_id: 1562822
description:
2025-11-18 01:38:00 dovecot_login authenticator failed for ([210.211.111.147]) [210.211.111.149]:25921: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 01:37:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<YjRoBNdD1ORw2eny>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 01:37:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@brinquelocacoes.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<FbCYBNdDRu1zR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 01:37:37 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:60251: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 01:37:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fernandotonet.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<c5YeBtdDGoV2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2025-11-18 01:38:06 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:35378: 535 Incorrect authentication data (set_id=sac)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
country_id: 1835841
description:
2025-11-18 01:37:39 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:47498: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 18 01:38:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<Lji6CddDdpWdQi/y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.37.16
country_id: 390903
description:
2025-11-18 01:38:08 dovecot_login authenticator failed for (149-210-37-16.mobile.nym.cosmote.net) [149.210.37.16]:53420: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.67.22
country_id: 1269750
description:
2025-11-18 01:38:24 dovecot_login authenticator failed for ([182.95.2.9]) [182.78.67.22]:56902: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</ns9CddDxMWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 01:38:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@oabsjp.org.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<1relCddDxsukXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 01:39:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<6Vz7CtdDOuJSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-11-18 01:38:14 dovecot_login authenticator failed for ([125.20.249.154]) [103.251.31.154]:48542: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.185.231
country_id: 290557
description:
2025-11-18 01:38:28 dovecot_login authenticator failed for ([94.204.185.231]) [94.204.185.231]:52525: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 01:38:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<zuY6CddDQpOl0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 01:38:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<yj0JCtdDyouP9IUv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 01:39:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<sFtyC9dDKo2ElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 01:39:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<+nbkC9dDEpdns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.107.161
country_id: 294640
description:
2025-11-18 01:39:21 dovecot_login authenticator failed for ([46.210.107.161]) [46.210.107.161]:36426: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 01:39:25 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50050: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fBTQDNdDNtaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.33.205
country_id: 2750405
description:
2025-11-18 01:39:34 dovecot_login authenticator failed for (ADMIN) [84.54.33.205]:49243: 535 Incorrect authentication data (set_id=tassiane@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 01:40:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<dCNWDtdDRqFn9M4G>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:40:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ujehDtdDYuWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 01:39:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<S75zC9dDAopvAEul>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 01:39:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<G1IDDddD0KiB4rs4>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 01:39:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<ISwgDddDTLPBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.76.73.4
country_id: 1814991
description:
2025-11-18 01:39:42 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:40093: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.12.170
country_id: 1269750
description:
2025-11-18 01:40:11 dovecot_login authenticator failed for ([103.171.12.170]) [103.171.12.170]:50936: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2025-11-18 01:40:20 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:60436: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OnVuENdDFIGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2025-11-18 01:40:49 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:58552: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.134.58
country_id: 1269750
description:
2025-11-18 01:41:02 dovecot_login authenticator failed for (nsg-static-58.134.76.182-airtel.com) [182.76.134.58]:51454: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 01:42:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<mBKZFddDMLqGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.19
country_id: 2186224
description:
2025-11-18 01:41:29 dovecot_login authenticator failed for ([121.73.163.19]) [121.73.163.19]:34734: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<c6j8E9dDzJmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2025-11-18 01:41:49 dovecot_login authenticator failed for ([220.67.139.254]) [221.145.5.14]:58322: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.209.221.7
country_id: 1861060
description:
2025-11-18 01:41:51 dovecot_login authenticator failed for ([8.209.221.7]) [8.209.221.7]:59158: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.87
country_id: 1814991
description:
2025-11-18 01:41:52 dovecot_login authenticator failed for ([36.135.62.86]) [36.135.62.87]:35172: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.239.129.2
country_id: 1814991
description:
2025-11-18 01:41:27 dovecot_login authenticator failed for (3.129.239.124.broad.ts.he.dynamic.163data.com.cn) [124.239.129.2]:39630: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 01:42:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<upS3FddDfpEI1et7>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:43:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZiNaGddDSruxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 01:42:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<e4j2FddDEoUv7PP+>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 01:42:18 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52270: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.71.230.230
country_id: 1269750
description:
Nov 18 01:42:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=167.71.230.230, lip=200.150.196.245, session=<R50mF9dDuMqnR+bm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 01:42:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<pCuuGNdD7pNCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 170.64.193.104
country_id: 2077456
description:
Nov 18 01:42:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=170.64.193.104, lip=200.150.196.245, session=<owmtFtdDSq+qQMFo>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zSKLF9dDELGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 01:42:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<gZ/jF9dDjt1SczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-18 01:43:26 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:58950: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<44UoG9dDFsSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.195
country_id: 192950
description:
2025-11-18 01:43:13 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:48552: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 01:43:16 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51958: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.50.254.252
country_id: 2542007
description:
[2025-11-18 01:43:20 -0300] info [cpaneld] 102.50.254.252 - OIxlhfZ8< "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8W26HtdDguWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-11-18 01:44:49 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:56878: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-11-18 01:45:13 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:45819: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 01:45:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@toromartelinho.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<DNXLItdD6NhzR+4E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 01:45:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<KqNCI9dDduSl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-11-18 01:45:59 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:42078: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:46:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6jUbJNdDqJyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 01:45:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<X9YAIddDhr5ns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2025-11-18 01:45:14 dovecot_login authenticator failed for ([213.55.79.199]) [213.55.79.195]:33708: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.66.220.207
country_id: 2017370
description:
2025-11-18 01:45:25 dovecot_login authenticator failed for ([95.66.220.207]) [95.66.220.207]:29586: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<sZtIItdDMJWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-11-18 01:45:47 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:45128: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.172.33.52
country_id: 1814991
description:
2025-11-18 01:46:00 dovecot_login authenticator failed for ([180.172.33.52]) [180.172.33.52]:36269: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.182.10
country_id: 1814991
description:
2025-11-18 01:46:32 dovecot_login authenticator failed for ([59.46.182.10]) [59.46.182.10]:50006: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 01:46:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<QUifJtdDmKtA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 01:46:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<QuAwJNdDAoeB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.55.131.144
country_id: 1694008
description:
2025-11-18 01:46:19 dovecot_login authenticator failed for (122.55.143.46.static.pldt.net) [122.55.131.144]:33902: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.254.255.247
country_id: 1814991
description:
2025-11-18 01:46:27 dovecot_login authenticator failed for ([114.254.255.247]) [114.254.255.247]:36493: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8M/WJddDSqmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 01:47:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<L/M7KddD4tQ+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 01:47:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<fmBJKddDwL0tPZWl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<byJ3KddDpruxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 01:47:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<wZ2fKddDDLNn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 01:47:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<qZFLKNdDyMDSchJs>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:49:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Me3QLtdDFtuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 01:48:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=</ujSLNdD6omvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.0.144
country_id: 2077456
description:
2025-11-18 01:48:32 dovecot_login authenticator failed for 121-44-0-144.tpgi.com.au [121.44.0.144]:42729: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 01:49:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<rB6TLtdDjI1CYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 01:48:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<8sS6K9dDkoVrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2025-11-18 01:48:19 dovecot_login authenticator failed for ([221.145.5.14]) [221.145.5.14]:60781: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<GpACLddD/NOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 01:48:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<FFGALtdD2u1ns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2025-11-18 01:49:12 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:47190: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 01:49:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<r3bAL9dDd853xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2025-11-18 01:49:24 dovecot_login authenticator failed for ([192.34.164.13]) [192.34.164.13]:56282: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:49:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7D6fMNdDguqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 01:49:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<H0yNMddDxouUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2025-11-18 01:49:59 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:39068: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.34.237.45
country_id: 285570
description:
2025-11-18 01:50:24 dovecot_login authenticator failed for ([37.34.237.45]) [37.34.237.45]:42186: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 01:50:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<TlWVM9dDxMgkMrBu>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SxQxNNdDuI6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 01:50:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@f5assessoria.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<hWXRNNdD6op2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.29.136
country_id: 2017370
description:
2025-11-18 01:50:51 dovecot_login authenticator failed for ([31.173.29.136]) [31.173.29.136]:57144: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 01:51:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<ZXrHNddDmrEXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 01:50:45 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:58974: 535 Incorrect authentication data (set_id=sales@jacgeneralcleaning.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2025-11-18 01:50:55 dovecot_login authenticator failed for ([197.231.202.201]) [197.231.202.201]:55068: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.34.2.179
country_id: 2017370
description:
2025-11-18 01:51:11 dovecot_login authenticator failed for ([77.34.2.179]) [77.34.2.179]:52474: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 01:51:12 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52069: 535 Incorrect authentication data (set_id=contato@asscar.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<i8DBN9dD1KGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 01:51:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<pg2nN9dDpsoO4dKR>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 01:51:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<qATCN9dDCKHSchJs>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:52:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0/6POddD9K+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Nov 18 01:52:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=<5wHOO9dD+qTBHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 01:52:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<7TewOddDCro+PIOJ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VFlQO9dDZLixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 01:52:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<HsljO9dDartn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-11-18 01:52:40 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:45120: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 01:53:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=</on+PddDuIE+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 01:53:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<R6AuPtdD8IqB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 01:53:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<JNESPtdDrIcrmxBp>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JqXiPtdDNM+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 01:53:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<6ES/PtdDvKml0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-11-18 01:53:47 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:50736: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.31.138.38
country_id: 3469034
description:
2025-11-18 01:53:22 dovecot_plain authenticator failed for 189-31-138-38.user3p.v-tal.net.br ([192.168.56.1]) [189.31.138.38]:61814: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 01:53:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<82ayPtdDWNIv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 01:53:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dradienecougo.com>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<WEQUQNdD8qGYNbyQ>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:55:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JNRCRNdDHu2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.205.20.70
country_id: 6251999
description:
2025-11-18 01:55:06 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:51665: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.199.168
country_id: 1562822
description:
2025-11-18 01:54:10 dovecot_login authenticator failed for ([171.244.199.168]) [171.244.199.168]:39724: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 01:54:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<xf+OQddDft5SczCz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lkJzQtdDoN6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 01:54:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=</FUNQ9dDZq2UcQQF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<A0ISRtdDUoexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 01:55:35 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51590: 535 Incorrect authentication data (set_id=curitiba@asscar.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 01:55:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<lH+DRtdDkotrhr+5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 01:55:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=</LQSR9dDmLMtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.15.69
country_id: 3469034
description:
2025-11-18 01:56:02 dovecot_login authenticator failed for (177-174-15-89.user.vivozap.com.br) [177.174.15.69]:51400: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.142.48.143
country_id: 2017370
description:
2025-11-18 01:56:48 dovecot_login authenticator failed for (213.142.48.143-FTTB.planeta.tc) [213.142.48.143]:57255: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.194
country_id: 1819730
description:
2025-11-18 01:56:26 dovecot_login authenticator failed for (m121-202-195-194.smartone.com) [121.202.195.194]:60948: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.64.123.166
country_id: 3932488
description:
2025-11-18 01:56:27 dovecot_login authenticator failed for ([181.64.123.166]) [181.64.123.166]:46186: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vB2gSddDPqGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-11-18 01:56:41 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:45614: 535 Incorrect authentication data (set_id=lucas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-11-18 01:56:41 dovecot_login authenticator failed for (91-219-196-17.planeta.dn.ua) [91.219.196.17]:57882: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.238.254.156
country_id: 2661886
description:
2025-11-18 01:56:21 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se [213.238.254.156]:36450: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-18 01:56:39 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:33884: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2025-11-18 01:57:11 dovecot_login authenticator failed for 95-210-105-202.ip.skylogicnet.com [95.210.105.202]:49759: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rPwtTddDUrexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-11-18 01:57:52 dovecot_login authenticator failed for ([152.52.246.178]) [152.52.246.178]:37144: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-11-18 01:58:06 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:34090: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.79.21
country_id: 1814991
description:
2025-11-18 01:57:46 dovecot_login authenticator failed for (251.78.212.118.adsl-pool.jx.chinaunicom.com) [118.212.79.21]:50622: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
country_id: 3144096
description:
2025-11-18 01:57:47 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:43124: 535 Incorrect authentication data (set_id=loopert@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2025-11-18 01:57:59 dovecot_login authenticator failed for ([45.82.109.136]) [45.82.109.136]:39634: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:58:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JwP9TtdDJr+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.27.237
country_id: 2077456
description:
2025-11-18 01:58:00 dovecot_login authenticator failed for ([120.157.27.237]) [120.157.27.237]:44682: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.222.23.245
country_id: 6252001
description:
2025-11-18 01:58:04 dovecot_login authenticator failed for ([158.222.23.245]) [158.222.23.245]:44190: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 18 01:57:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<3NQKTNdDOppbejg7>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 18 01:57:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@joelbuenoadvogados.com.br>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<NJzHTNdDzI8rZDwA>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 01:57:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<tMMKTddDSuKElIx5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.144.37.102
country_id: 1269750
description:
2025-11-18 01:57:44 dovecot_login authenticator failed for ([103.144.37.102]) [103.144.37.102]:35591: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2025-11-18 01:57:31 dovecot_login authenticator failed for ([121.128.76.110]) [211.196.31.2]:47313: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.23.117.108
country_id: 1814991
description:
2025-11-18 01:57:48 dovecot_login authenticator failed for ([111.23.117.108]) [111.23.117.108]:52247: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-11-18 01:57:54 dovecot_login authenticator failed for (2-55-122-202.orange.net.il) [2.55.122.202]:51157: 535 Incorrect authentication data (set_id=loopert)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.201.59.224
country_id: 1835841
description:
2025-11-18 01:58:02 dovecot_login authenticator failed for ([119.201.59.224]) [119.201.59.224]:59387: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.125.68.208
country_id: 1835841
description:
2025-11-18 01:58:09 dovecot_login authenticator failed for ([175.125.68.208]) [175.125.68.208]:46740: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.93.190
country_id: 1269750
description:
2025-11-18 01:58:20 dovecot_login authenticator failed for ([182.78.93.190]) [182.78.93.190]:45730: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2025-11-18 01:58:25 dovecot_login authenticator failed for ([61.72.58.242]) [61.72.58.242]:41207: 535 Incorrect authentication data (set_id=igreja@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.144
country_id: 1819730
description:
2025-11-18 01:58:25 dovecot_login authenticator failed for 144.46.246.220.static.netvigator.com [220.246.46.144]:51247: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<LdLLUNdDWsexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-18 01:58:54 dovecot_login authenticator failed for (dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:55836: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2025-11-18 01:58:36 dovecot_login authenticator failed for ([45.82.109.136]) [45.82.109.136]:41262: 535 Incorrect authentication data (set_id=igreja)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-11-18 01:58:42 dovecot_login authenticator failed for (static-ip-1815407040.cable.net.co) [181.54.70.40]:55234: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.87
country_id: 3625428
description:
2025-11-18 01:58:45 dovecot_login authenticator failed for ([190.114.243.80]) [190.114.243.87]:38195: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 01:59:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<k2PMVNdDPq5A44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
country_id: 1880251
description:
2025-11-18 01:59:58 dovecot_login authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:48538: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 01:59:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<iL2OU9dD0oUv+yzS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 01:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yK9UVNdDgt6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 01:59:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<Ch4HVddD7Ix3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 01:59:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@oabsjp.org.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<xyNrVddD+s52wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
country_id: 1835841
description:
2025-11-18 01:59:38 dovecot_login authenticator failed for ([59.22.68.213]) [59.22.68.213]:39710: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 18 01:59:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<FKXWVNdDLuN57bKF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 02:00:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<sBCwV9dDTrql0xnK>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:00:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<C771V9dDvIqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2025-11-18 02:00:43 dovecot_login authenticator failed for ([167.250.118.3]) [167.250.118.3]:59088: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 02:00:46 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51717: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:01:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8Hy+WddDcpOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 02:00:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<7jJFWNdDOLVAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-11-18 02:00:44 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:50204: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.249.175.243
country_id: 298795
description:
2025-11-18 02:01:01 dovecot_login authenticator failed for ([185.250.240.220]) [88.249.175.243]:6021: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.111
country_id: 1814991
description:
2025-11-18 02:01:08 dovecot_login authenticator failed for ([27.24.141.111]) [27.24.141.111]:42650: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 02:01:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<JozoWtdDlNuB4rs4>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:01:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Wb2JW9dDLJyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.107.193
country_id: 1814991
description:
2025-11-18 02:01:45 dovecot_login authenticator failed for ([220.180.107.193]) [220.180.107.193]:41249: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.64.205.45
country_id: 3017382
description:
2025-11-18 02:02:10 dovecot_login authenticator failed for 82-64-205-45.subs.proxad.net [82.64.205.45]:14521: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.27.205.159
country_id: 1814991
description:
2025-11-18 02:02:23 dovecot_login authenticator failed for ([218.27.205.159]) [218.27.205.159]:35792: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.64
country_id: 1668284
description:
2025-11-18 02:02:27 dovecot_login authenticator failed for 111-70-19-64.emome-ip.hinet.net [111.70.19.64]:33279: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.144.150
country_id: 1269750
description:
2025-11-18 02:02:43 dovecot_login authenticator failed for (nsg-corporate-150.144.185.122.airtel.in) [122.185.144.150]:36104: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 02:03:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<p3zUYNdDBtmGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.196.134
country_id: 1814991
description:
2025-11-18 02:02:10 dovecot_login authenticator failed for ([220.189.196.134]) [220.189.196.134]:47081: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OVEXX9dDBrSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 02:02:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<F0GHX9dDnuSkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 02:02:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<eaaIX9dDzJad5hjP>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WrKsYtdDbMuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.177.253.166
country_id: 1562822
description:
Nov 18 02:03:36 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=14.177.253.166, lip=200.150.196.245, TLS, session=<wIqbYddDaLUOsf2m>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2025-11-18 02:03:48 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:63492: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.97.109.192
country_id: 1835841
description:
2025-11-18 02:03:54 dovecot_login authenticator failed for ([210.97.109.192]) [210.97.109.192]:49104: 535 Incorrect authentication data (set_id=unijovem)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 02:04:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<NL+JZNdD5savfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.187.66.166
country_id: 1814991
description:
Nov 18 02:03:13 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@sindeesfort.com.br>, method=PLAIN, rip=117.187.66.166, lip=200.150.196.245, TLS, session=<+2ABYNdD/Lt1u0Km>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 109.125.247.26
country_id: 798544
description:
Nov 18 02:03:20 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos>, method=PLAIN, rip=109.125.247.26, lip=200.150.196.245, TLS, session=</3baYNdDFbNtffca>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 02:03:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<iyfXYddDGpJns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 02:03:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<mjkKY9dD/u5o7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 02:03:42 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51616: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:04:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UTZtZNdDANOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.214.203
country_id: 3865483
description:
2025-11-18 02:03:16 dovecot_login authenticator failed for (red.138.118.214.203.ssservicios.com.ar) [138.118.214.203]:45283: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 02:03:27 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:56777: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.179
country_id: 1668284
description:
2025-11-18 02:03:37 dovecot_login authenticator failed for 111-70-49-179.emome-ip.hinet.net [111.70.49.179]:57467: 535 Incorrect authentication data (set_id=unijovem@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.68.141
country_id: 294640
description:
2025-11-18 02:04:42 dovecot_login authenticator failed for (31-154-68-141.orange.net.il) [2.55.68.141]:56164: 535 Incorrect authentication data (set_id=ti)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 150.95.31.158
country_id: 1605651
description:
Nov 18 02:04:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@profetizandoasmulheres.com.br>, method=PLAIN, rip=150.95.31.158, lip=200.150.196.245, session=<GrbGZtdD+ICWXx+e>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.238.209.37
country_id: 1819730
description:
2025-11-18 02:04:44 dovecot_plain authenticator failed for (s4300ciysdvuz66wgofiavhslf0c) [47.238.209.37]:37600: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 02:04:55 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51580: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.47
country_id: 1168579
description:
2025-11-18 02:04:18 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:59181: 535 Incorrect authentication data (set_id=ti@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.82.9.238
country_id: 6252001
description:
2025-11-18 02:04:25 dovecot_login authenticator failed for (1075fm.com.br) [206.82.9.238]:52614: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zk4+ZtdDeOGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 02:05:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<NjawaNdDyM1SnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 02:05:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<mKoYaddDtLxxoZB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 02:05:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<ru8maddDOuo7GIXF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2tvMaddDzoWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2025-11-18 02:05:37 dovecot_login authenticator failed for ([65.20.204.88]) [65.20.204.88]:41710: 535 Incorrect authentication data (set_id=toro@toromartelinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 02:05:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<4Doka9dDZugtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 02:05:18 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50207: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 02:06:07 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51992: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-11-18 02:06:10 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:42820: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.124
country_id: 3996063
description:
2025-11-18 02:06:17 dovecot_login authenticator failed for ([177.236.145.124]) [177.236.145.124]:48045: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.75.106.225
country_id: 290557
description:
2025-11-18 02:06:22 dovecot_login authenticator failed for ([91.75.106.225]) [91.75.106.225]:47239: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.222.188.154
country_id: 1814991
description:
2025-11-18 02:06:34 dovecot_login authenticator failed for ([58.222.188.154]) [58.222.188.154]:50866: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.87
country_id: 3625428
description:
2025-11-18 02:06:55 dovecot_login authenticator failed for ([190.114.243.80]) [190.114.243.87]:51209: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 02:07:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<7NLzbtdD+oUtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 18 02:06:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<w496bNdDiuYvT1jH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QOFebddDVJ6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2025-11-18 02:06:47 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:60542: 535 Incorrect authentication data (set_id=toro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 02:06:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<p5JSbtdDlpto7MS0>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:07:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<W38wb9dDOKaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 02:07:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@adpiraquara.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<0Jheb9dDmJKKxX03>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:07:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ik3/cNdDIraxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 18 02:07:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<DYHEcddD32i317Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.100.60.0
country_id: 1819730
description:
Nov 18 02:08:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@huboperacoes.com>, method=PLAIN, rip=43.100.60.0, lip=200.150.196.245, session=<rL6DctdD0MIrZDwA>


plugin: ossec
rule: 12004
name: Possible Dovecot CVE-2019-11500 attempt
abuser: 3.131.215.38
country_id: 6252001
description:
Nov 18 02:08:01 hosting dovecot: imap-login: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=3.131.215.38, lip=186.233.225.118, session=<LFeyctdDmI8Dg9cm>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 02:08:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<8PTvctdDAPlxoZB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 152.53.188.144
country_id: 2921044
description:
Nov 18 02:09:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@iemif.org>, method=PLAIN, rip=152.53.188.144, lip=200.150.196.245, session=<+m1QdtdDIM6YNbyQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 02:08:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<ypR8c9dD4rykXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 02:08:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<XGpudNdDNtaP9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 02:08:35 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64847: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.177.110
country_id: 1835841
description:
2025-11-18 02:08:48 dovecot_login authenticator failed for ([218.154.54.5]) [222.108.177.110]:50645: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.185.231
country_id: 290557
description:
2025-11-18 02:09:01 dovecot_login authenticator failed for ([94.204.185.231]) [94.204.185.231]:44895: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.17.130
country_id: 2017370
description:
2025-11-18 02:08:24 dovecot_login authenticator failed for ([5.142.17.130]) [5.142.17.130]:52182: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<486IdNdDTMaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 02:08:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<VVcxdddD2swkMrBu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 02:08:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<4kI0dddDNopA44h6>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:10:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vJHreddDruexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-11-18 02:09:27 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:57636: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<CYUYeNdDJt6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.242.182.159
country_id: 2635167
description:
2025-11-18 02:09:35 dovecot_login authenticator failed for host-89-242-182-159.as13285.net [89.242.182.159]:57310: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.17.247.90
country_id: 1814991
description:
2025-11-18 02:09:40 dovecot_login authenticator failed for (90.247.17.175.adsl-pool.jlccptt.net.cn) [175.17.247.90]:34890: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.17.96
country_id: 2077456
description:
2025-11-18 02:09:54 dovecot_login authenticator failed for ([120.157.17.96]) [120.157.17.96]:50574: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 02:09:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<vclyeddDXOhAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-18 02:10:11 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:61034: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 02:10:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<OhGietdDWKhw2eny>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 02:10:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<fnf6etdDgJB9gnHM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cCC3e9dDAoexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-11-18 02:10:38 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:33236: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.5.76.239
country_id: 1814991
description:
2025-11-18 02:11:00 dovecot_login authenticator failed for ([112.5.76.239]) [112.5.76.239]:54032: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 02:11:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<S/jFftdD3NWUcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 18 02:11:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<lScef9dD4LCd5hjP>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:11:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Q8NNf9dDZJqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 02:11:46 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51783: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 02:11:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<B1h1gNdDYoZ3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.253.159.81
country_id: 732800
description:
Nov 18 02:12:08 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos>, method=PLAIN, rip=185.253.159.81, lip=200.150.196.245, TLS, session=<oAJZgNdDGqy5/Z9R>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 138.197.125.55
country_id: 6252001
description:
Nov 18 02:12:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@transol.com.br>, method=PLAIN, rip=138.197.125.55, lip=200.150.196.245, session=<eL+2gddD/hCKxX03>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 02:12:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<fH1xgtdDMqfBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 02:13:01 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51945: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:13:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UZunhNdDfMOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 02:13:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<Xp6ihNdD5rYnaoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 02:12:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<9oukgddDfrUI2Cjk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.203.37.225
country_id: 6252001
description:
2025-11-18 02:12:19 dovecot_login authenticator failed for 104-203-37-225.static4.bluestreamfiber.net [104.203.37.225]:42197: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<d3DSgtdDvraxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.87.177.252
country_id: 6252001
description:
2025-11-18 02:12:59 dovecot_login authenticator failed for ([38.87.177.252]) [38.87.177.252]:50504: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 02:13:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<W2h5hddDwrhCYSpH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QYJqhtdD2syxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.252
country_id: 2510769
description:
2025-11-18 02:13:47 dovecot_login authenticator failed for (109-69-15-252.puntdacces.coop) [109.69.15.252]:44052: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.111.2
country_id: 1562822
description:
2025-11-18 02:14:01 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:51798: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 18 02:14:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<TYW4iNdD4M0zTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.31.138.38
country_id: 3469034
description:
2025-11-18 02:14:19 dovecot_plain authenticator failed for 189-31-138-38.user3p.v-tal.net.br ([192.168.56.1]) [189.31.138.38]:50495: 535 Incorrect authentication data (set_id=secretaria@adlondrina.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4GwAitdDUOOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 02:14:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<zbr9iddDvKBvAEul>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 02:14:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<w6cpi9dDrel3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 02:15:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<NY0mjNdDOt8naoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-18 02:15:13 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:37694: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2025-11-18 02:15:29 dovecot_login authenticator failed for 77-173-41-213.cust.keyyo.net [213.41.173.77]:43676: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:16:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6S5Zj9dDJJ6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 02:15:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<m0PdjNdDas99gnHM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 18 02:15:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<1Nz5jNdDiNEkMrGr>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hLWYjddDeIWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 02:15:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<FMvwjddDpqgXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 18 02:16:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<e/frkNdDYNIIiXsk>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7+EpkddDCKaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 132.148.140.121
country_id: 6252001
description:
Nov 18 02:16:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=132.148.140.121, lip=200.150.196.245, session=<d44xkddD5ruElIx5>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 02:16:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@pousadarincaoalegre.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<n6SgkddDlLErmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2025-11-18 02:16:59 dovecot_login authenticator failed for ([1.212.225.99]) [1.212.225.99]:33884: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.146.209
country_id: 3996063
description:
2025-11-18 02:17:15 dovecot_login authenticator failed for ([177.236.146.209]) [177.236.146.209]:38881: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.212.54
country_id: 99237
description:
2025-11-18 02:17:26 dovecot_login authenticator failed for ([62.201.212.54]) [62.201.212.54]:35990: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AOC+lNdDor2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2025-11-18 02:17:41 dovecot_login authenticator failed for ([61.72.58.242]) [61.72.58.242]:33110: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-18 02:17:48 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:43181: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:19:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+eQcmtdDut6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.135.166
country_id: 1820814
description:
2025-11-18 02:19:03 dovecot_login authenticator failed for (166-135.adsl.static.espeed.com.bn) [119.160.135.166]:37060: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 02:18:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@f5assessoria.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<fAH8l9dDJNikXLll>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1c1OmNdDxtWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 02:18:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<NyvNmNdD4NOB4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.20.193
country_id: 290557
description:
2025-11-18 02:18:18 dovecot_login authenticator failed for ([94.207.20.193]) [94.207.20.193]:54288: 535 Incorrect authentication data (set_id=doninha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.17.130
country_id: 2017370
description:
2025-11-18 02:18:28 dovecot_login authenticator failed for ([5.142.17.130]) [5.142.17.130]:44806: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 02:18:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<cV8imddDMoGP9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.103.253.48
country_id: 1820814
description:
2025-11-18 02:19:36 dovecot_login authenticator failed for (48-253.adsl.static.espeed.com.bn) [118.103.253.48]:45077: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 185.124.182.191
country_id: 3175395
description:
Nov 18 02:19:38 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas@nextviagem.com>, method=PLAIN, rip=185.124.182.191, lip=200.150.196.245, TLS, session=<Fcoum9dDZsC5fLa/>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 02:19:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<1eaQnNdDlqBn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.133.98
country_id: 1814991
description:
2025-11-18 02:19:59 dovecot_login authenticator failed for ([221.224.133.98]) [221.224.133.98]:55736: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 02:20:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<AeKqnddDXqRSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.88.85
country_id: 3996063
description:
2025-11-18 02:20:05 dovecot_login authenticator failed for (201.172.88.85-clientes-izzi.mx) [201.172.88.85]:51691: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.15.252
country_id: 2510769
description:
2025-11-18 02:19:44 dovecot_login authenticator failed for (109-69-15-252.puntdacces.coop) [109.69.15.252]:49933: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.251.69.12
country_id: 1269750
description:
2025-11-18 02:19:54 dovecot_login authenticator failed for ([45.251.69.12]) [45.251.69.12]:33303: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2025-11-18 02:20:05 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:63586: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
country_id: 6252001
description:
2025-11-18 02:19:30 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:46748: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 02:19:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<kmI+nNdDloFvAEul>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 02:20:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<2+O0nddDGK6l0iHB>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 02:19:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<u+Tom9dD4OaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2025-11-18 02:19:41 dovecot_login authenticator failed for ([183.104.220.84]) [183.104.220.84]:55488: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.31.138.38
country_id: 3469034
description:
2025-11-18 02:19:48 dovecot_plain authenticator failed for 189-31-138-38.user3p.v-tal.net.br ([192.168.56.1]) [189.31.138.38]:55346: 535 Incorrect authentication data (set_id=secretaria@cieadep.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.51.166
country_id: 1269750
description:
2025-11-18 02:19:52 dovecot_login authenticator failed for ([125.23.112.209]) [182.95.51.166]:47820: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 02:20:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<Gn+ynddDPq1ns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.115.177.212
country_id: 6251999
description:
2025-11-18 02:20:17 dovecot_login authenticator failed for ([209.115.177.212]) [209.115.177.212]:51374: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.248.31
country_id: 1835841
description:
2025-11-18 02:20:35 dovecot_login authenticator failed for ([121.188.248.31]) [121.188.248.31]:35804: 535 Incorrect authentication data (set_id=contato)


