# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.161.232.9
country_id: 6252001
description:
2025-11-18 09:41:42 dovecot_login authenticator failed for ip98-161-232-9.ph.ph.cox.net [98.161.232.9]:39070: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 18 09:41:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<GZipyd1DtJ8IiXsk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 09:42:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<lrMkyt1D8rZA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 09:41:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<XfuVx91DPqNns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 09:41:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<TskKyN1DLsGB4rs4>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WDxnyt1DeNKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.83.124.138
country_id: 1814991
description:
2025-11-18 09:41:12 dovecot_login authenticator failed for ([1.83.124.138]) [1.83.124.138]:34516: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 09:41:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<vHnTyd1DvuFCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.78.13.13
country_id: 732800
description:
2025-11-18 09:41:22 dovecot_login authenticator failed for inkas.networx-bg.com [77.78.13.13]:52494: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.86.13
country_id: 3996063
description:
2025-11-18 09:41:34 dovecot_login authenticator failed for (201.173.86.13-clientes-izzi.mx) [201.173.86.13]:41325: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.83
country_id: 1814991
description:
2025-11-18 09:41:57 dovecot_login authenticator failed for ([111.26.63.83]) [111.26.63.83]:40988: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.2.166.30
country_id: 2635167
description:
2025-11-18 09:41:31 dovecot_login authenticator failed for ([151.2.166.30]) [151.2.166.30]:50831: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.39.128.68
country_id: 1814991
description:
2025-11-18 09:42:43 dovecot_login authenticator failed for ([27.39.128.68]) [27.39.128.68]:50134: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 18 09:42:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<3v1Azd1DqrqdQi/y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2025-11-18 09:42:13 dovecot_plain authenticator failed for c-174-161-27-82.hsd1.tn.comcast.net (pomak) [174.161.27.82]:59230: 535 Incorrect authentication data (set_id=novidadevida@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 09:42:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<Ozgcy91Dit2B4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2025-11-18 09:42:23 dovecot_login authenticator failed for ([65.20.153.146]) [65.20.153.146]:49191: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2/8vzN1DBtyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.68.141
country_id: 294640
description:
2025-11-18 09:42:41 dovecot_login authenticator failed for (31-154-68-141.orange.net.il) [2.55.68.141]:38496: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.194.94
country_id: 1269750
description:
2025-11-18 09:43:35 dovecot_login authenticator failed for ([27.123.91.196]) [152.52.194.94]:52440: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.104
country_id: 3469034
description:
2025-11-18 09:43:58 H=(localhost) [179.0.178.104]:62074 F=<postmaster@mail.com> rejected RCPT <toninho@cruzeirosgospel.com.br>: No Such User Here


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-11-18 09:43:13 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:35915: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 09:43:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<DXSzzt1DpouvfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 09:43:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<SWoxz91DwYN3xBIC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rem/z91DKoixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-18 09:43:33 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:51214: 535 Incorrect authentication data (set_id=processos.daniel@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.168.71.109
country_id: 1835841
description:
2025-11-18 09:43:09 dovecot_login authenticator failed for ([112.168.71.109]) [112.168.71.109]:41056: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 09:43:12 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:51333: 535 Incorrect authentication data (set_id=root@jacgeneralcleaning.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-18 09:44:08 H=(195.3.134.135) [179.0.178.53]:56271 F=<erictremblaysi@hotmail.com> rejected RCPT <miguelfalabella@transol.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:56271 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 09:44:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<CfjG091DnMJn9M4G>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 09:44:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<envM1N1DqLB9gnHM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<m5cX1d1D2KuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 09:44:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@oabsjp.org.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<Gi9w1N1DAqKkXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.27.205.159
country_id: 1814991
description:
2025-11-18 09:44:22 dovecot_login authenticator failed for ([218.27.205.159]) [218.27.205.159]:51484: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qwNN091D/qCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 09:44:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<JxsZ091DlINxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.130.80
country_id: 1269750
description:
2025-11-18 09:44:38 dovecot_login authenticator failed for ([103.83.130.80]) [103.83.130.80]:41936: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 09:44:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<v7el091DeLaUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 09:45:22 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51972: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gS3o1t1DJLWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 18 09:45:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<nlLC1t1Doyu317Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 09:45:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<1qv91t1Dtqk+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.0.216
country_id: 1835841
description:
2025-11-18 09:45:48 dovecot_login authenticator failed for ([118.60.136.49]) [183.107.0.216]:59784: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 09:45:53 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:60992: 535 Incorrect authentication data (set_id=postamster@educacionalevangelico.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 09:46:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<+kp22t1DOMg7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-11-18 09:46:53 dovecot_login authenticator failed for ([191.102.123.13]) [186.179.100.129]:1044: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2025-11-18 09:46:29 dovecot_login authenticator failed for (dynamic-adsl.viettel.vn) [116.98.104.138]:53788: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.135.236.42
country_id: 2017370
description:
2025-11-18 09:46:30 dovecot_login authenticator failed for ([79.135.236.42]) [79.135.236.42]:58350: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.15.96.26
country_id: 3469034
description:
2025-11-18 09:46:35 dovecot_login authenticator failed for ([190.15.98.153]) [190.15.96.26]:58269: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2025-11-18 09:46:57 dovecot_login authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:40386: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.75.158.202
country_id: 1269750
description:
2025-11-18 09:46:47 dovecot_login authenticator failed for ([103.75.158.202]) [103.75.158.202]:49697: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 09:46:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<Xf792d1DRrEv+yzS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<be+A2t1DgM+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.58
country_id: 1819730
description:
2025-11-18 09:46:41 dovecot_login authenticator failed for 058.151.48.116.static.netvigator.com [116.48.151.58]:59182: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 216.238.113.176
country_id: 3469034
description:
Nov 18 09:46:57 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=216.238.113.176, lip=200.150.196.245, TLS, session=<2DX+291DVNDY7nGw>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 216.238.113.176
country_id: 3469034
description:
Nov 18 09:46:58 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=216.238.113.176, lip=200.150.196.245, session=<F/n/291DYNDY7nGw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-18 09:47:11 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:49145: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 09:47:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<Mmzr3N1DuMlns7yS>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 191.177.193.122
country_id: 3469034
description:
[2025-11-18 09:47:23 -0300] info [webmaild] 191.177.193.122 - ieqcampocomprido@ieq.com.br "GET /cpsess3858446217/3rdparty/roundcube/index.php?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<N3IS3t1DCOuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-11-18 09:47:57 dovecot_login authenticator failed for ([186.238.247.238]) [186.238.247.238]:48764: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 09:47:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<YbZu3N1DuN5xoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.90.176
country_id: 690791
description:
2025-11-18 09:48:22 dovecot_plain authenticator failed for (fradoss) [178.16.90.176]:40252: 535 Incorrect authentication data (set_id=novidadevida@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.185.173.167
country_id: 1814991
description:
2025-11-18 09:48:29 dovecot_login authenticator failed for ([110.185.173.167]) [110.185.173.167]:34750: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.10.156.230
country_id: 1819730
description:
Nov 18 09:48:37 hosting dovecot: imap-login: Disconnected: Connection closed: read(size=353) failed: Connection reset by peer (user disabled): user=<rodrigo@89fmjoinville.com.br>, method=PLAIN, rip=113.10.156.230, lip=200.150.196.245, TLS: read(size=353) failed: Connection reset by peer, session=<3lF94N1DdeRxCpzm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-11-18 09:48:54 dovecot_login authenticator failed for ([185.134.179.106]) [185.101.16.250]:56808: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rtuk4d1DDJ+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 09:48:44 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:54657: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.189.100
country_id: 1269750
description:
2025-11-18 09:48:51 dovecot_login authenticator failed for ([122.175.189.100]) [122.175.189.100]:35227: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.79.87.53
country_id: 6252001
description:
2025-11-18 09:48:25 dovecot_login authenticator failed for wsip-174-79-87-53.br.br.cox.net [174.79.87.53]:36385: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.144
country_id: 1835841
description:
2025-11-18 09:48:26 dovecot_login authenticator failed for ([121.131.220.144]) [121.131.220.144]:45306: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 09:48:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<D6FP4d1DVMhAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.33
country_id: 1819730
description:
2025-11-18 09:48:35 dovecot_login authenticator failed for (223-197-145-33.static.imsbiz.com) [223.197.145.33]:61293: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-18 09:48:41 dovecot_login authenticator failed for ([187.6.121.246]) [187.6.121.246]:37273: 535 Incorrect authentication data (set_id=juridico)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.166.82.252
country_id: 1880251
description:
2025-11-18 09:48:16 dovecot_login authenticator failed for (bb202.166.82.252.singnet.com.sg) [202.166.82.252]:56586: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 09:48:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<hnnJ4N1DmKstPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.27.93.138
country_id: 1835841
description:
2025-11-18 09:48:25 dovecot_login authenticator failed for ([59.27.93.138]) [59.27.93.138]:44798: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 09:48:34 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:61293: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.210
country_id: 2635167
description:
Nov 18 09:48:39 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.210, lip=200.150.207.122, TLS, session=<FyYS4t1D09a594nS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.140.212.144
country_id: 2017370
description:
2025-11-18 09:48:42 dovecot_login authenticator failed for ([5.140.212.144]) [5.140.212.144]:57751: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.164.188
country_id: 1819730
description:
2025-11-18 09:48:50 dovecot_login authenticator failed for (223-197-164-188.static.imsbiz.com) [223.197.164.188]:61872: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-18 09:49:14 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:51228: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:50:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Lyf75t1D/NCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.223.133.104
country_id: 3469034
description:
2025-11-18 09:50:05 dovecot_login authenticator failed for (104.133.223.177.static.yepnet.com.br) [177.223.133.104]:53718: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.36.193.230
country_id: 1814991
description:
2025-11-18 09:49:08 dovecot_login authenticator failed for ([119.36.194.248]) [119.36.193.230]:52122: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.92.116.88
country_id: 1814991
description:
2025-11-18 09:49:16 dovecot_login authenticator failed for ([113.57.108.79]) [183.92.116.88]:2465: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 09:49:23 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:63501: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.238.15.224
country_id: 1835841
description:
2025-11-18 09:49:29 dovecot_login authenticator failed for ([218.238.15.224]) [218.238.15.224]:39208: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DgU15d1D3ryxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-11-18 09:49:50 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:54931: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2025-11-18 09:50:02 dovecot_login authenticator failed for ([175.203.199.118]) [175.203.199.118]:2001: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-18 09:50:41 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:58709: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 09:50:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<xOtG6d1DzJNns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 09:50:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<1Ie06d1DpoJrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2025-11-18 09:50:53 dovecot_login authenticator failed for ([103.250.160.76]) [103.250.160.76]:54108: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.179.135.174
country_id: 2661886
description:
2025-11-18 09:50:54 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:47580: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.221.149
country_id: 2077456
description:
2025-11-18 09:50:57 dovecot_login authenticator failed for ([120.157.221.149]) [120.157.221.149]:57818: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 09:50:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<+bDR591DDIt9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-18 09:50:25 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:40518: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UjDJ6N1DNuCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-18 09:50:43 dovecot_login authenticator failed for (dsl-del-dynamic-225.66.246.61.airtelbroadband.in) [182.95.174.18]:36454: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.25.183
country_id: 298795
description:
2025-11-18 09:50:52 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:38889: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 09:51:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<U1y3691DMtuGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2025-11-18 09:51:33 dovecot_login authenticator failed for 063.40.246.220.static.netvigator.com [220.246.40.63]:38540: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-18 09:51:28 dovecot_login authenticator failed for ([125.17.106.225]) [122.187.220.30]:40958: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<96Za7N1DRKGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 09:51:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<jSSI7N1DVqNCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 09:51:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<hhtl7N1D5oc+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-18 09:51:44 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:48489: 535 Incorrect authentication data (set_id=presidencia)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 09:51:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<O+Sx6t1DSCBo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2025-11-18 09:51:18 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:56148: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-11-18 09:51:20 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:59225: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.30.212.99
country_id: 298795
description:
2025-11-18 09:51:45 dovecot_login authenticator failed for ([176.30.212.99]) [176.30.212.99]:44940: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
country_id: 1814991
description:
2025-11-18 09:51:52 dovecot_login authenticator failed for ([112.6.73.140]) [221.2.40.10]:34545: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:53:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<X1G48d1DOtKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.222.188.154
country_id: 1814991
description:
2025-11-18 09:53:06 dovecot_login authenticator failed for ([58.222.188.154]) [58.222.188.154]:63680: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 09:52:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<YvhL7t1DKNpvAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2025-11-18 09:52:14 dovecot_login authenticator failed for (nsg-corporate-130.221.187.122.airtel.in) [122.187.221.130]:36586: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<pkXq791DEL2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 09:52:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<BgzN8N1DDM0v+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2025-11-18 09:53:00 dovecot_login authenticator failed for ([211.169.212.206]) [211.169.212.206]:51553: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2025-11-18 09:54:06 dovecot_login authenticator failed for (m121-202-198-98.smartone.com) [121.202.198.98]:38576: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 18 09:53:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<d7hO8t1DYo8vT1jH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6DGC891DQOGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.4.78.74
country_id: 1814991
description:
2025-11-18 09:54:00 dovecot_login authenticator failed for ([111.4.78.74]) [111.4.78.74]:44992: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.238.101.209
country_id: 3932488
description:
2025-11-18 09:53:16 dovecot_login authenticator failed for ([190.238.101.209]) [190.238.101.209]:46362: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2025-11-18 09:53:23 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:52281: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.88
country_id: 1814991
description:
2025-11-18 09:53:57 dovecot_login authenticator failed for ([27.24.141.88]) [27.24.141.88]:35634: 535 Incorrect authentication data (set_id=presidencia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.186
country_id: 1668284
description:
2025-11-18 09:53:58 dovecot_login authenticator failed for 111-70-49-186.emome-ip.hinet.net [111.70.49.186]:42814: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.165.114
country_id: 1269750
description:
2025-11-18 09:54:01 dovecot_login authenticator failed for (static.ill.117.250.165.114.bsnl.co.in) [117.250.165.114]:40388: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 09:53:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<2RIf8t1DnM1n9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 09:53:34 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51454: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.97.138
country_id: 1814991
description:
2025-11-18 09:53:37 dovecot_login authenticator failed for ([1.180.97.138]) [1.180.97.138]:38050: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 09:53:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<T/VW9N1Dfs2P9IUv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rzEV991DgJaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.122.56.59
country_id: 2017370
description:
Nov 18 09:54:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=91.122.56.59, lip=200.150.196.245, session=<qDAJ991DaJRbejg7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.27.237
country_id: 2077456
description:
2025-11-18 09:54:47 dovecot_login authenticator failed for ([120.157.27.237]) [120.157.27.237]:51646: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-11-18 09:54:21 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:62568: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.180.58
country_id: 1835841
description:
2025-11-18 09:54:22 dovecot_login authenticator failed for ([114.30.180.58]) [114.30.180.58]:60047: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 09:54:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<e+Ou9t1DXAdo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-11-18 09:54:28 dovecot_login authenticator failed for (aes-static-041.100.144.59.airtel.in) [182.95.57.158]:47602: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 09:55:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@primiciapersianas.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<ld93+t1D+ut2wSaf>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<x56v+t1DEsOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 09:55:38 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51815: 535 Incorrect authentication data (set_id=nfe2@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
country_id: 1835841
description:
2025-11-18 09:55:57 dovecot_login authenticator failed for ([39.125.67.109]) [39.125.67.109]:36449: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 09:56:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<aOw0/N1DPYB3xBIC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:56:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uFBw/N1DStGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 43.155.16.105
country_id: 1819730
description:
Nov 18 09:55:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@toromartelinho.com.br>, method=PLAIN, rip=43.155.16.105, lip=200.150.196.245, session=<wxEG+t1D3McrmxBp>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.175.81.54
country_id: 2017370
description:
2025-11-18 09:55:52 dovecot_login authenticator failed for ([85.175.81.54]) [85.175.81.54]:39796: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.250.78.191
country_id: 3686110
description:
2025-11-18 09:55:59 dovecot_login authenticator failed for (static-adsl190-250-78-191.une.net.co) [190.250.78.191]:54518: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IBc5/t1D5t+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.85
country_id: 1814991
description:
2025-11-18 09:56:37 dovecot_login authenticator failed for ([36.135.62.84]) [36.135.62.85]:57614: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.82.49
country_id: 3996063
description:
2025-11-18 09:56:08 dovecot_login authenticator failed for (189.218.82.49-clientes-izzi.mx) [189.218.82.49]:47425: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.244.113.178
country_id: 2017370
description:
2025-11-18 09:56:12 dovecot_login authenticator failed for ([91.244.113.178]) [91.244.113.178]:53549: 535 Incorrect authentication data (set_id=secretarioadjunto)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 09:56:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<khMf/d1D3tQXXz9j>


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 201.22.53.135
country_id: 3469034
description:
Nov 18 09:57:01 hosting pure-ftpd: (opsconso@201.22.53.135) [NOTICE] /home/opsconso//public_html/wp-content/themes/ops/template-cartas.php uploaded  (15011 bytes, 535.85KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-11-18 09:57:31 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:37048: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2025-11-18 09:57:31 dovecot_login authenticator failed for ([38.141.252.55]) [38.141.252.55]:49224: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 09:57:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<tO3gAN5DRMMkMrBu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 09:57:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<8wo7Ad5DvLpvAEul>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.27.93.138
country_id: 1835841
description:
2025-11-18 09:57:29 dovecot_login authenticator failed for ([59.27.93.138]) [59.27.93.138]:36713: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
country_id: 2017370
description:
2025-11-18 09:57:23 dovecot_login authenticator failed for (22.32.117.87.donpac.ru) [87.117.32.22]:52580: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 09:57:51 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51993: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 09:57:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<mRDmAt5D9IFCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.234
country_id: 2186224
description:
2025-11-18 09:57:42 dovecot_login authenticator failed for ([121.73.168.234]) [121.73.168.234]:52970: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.6.226.122
country_id: 1562822
description:
2025-11-18 09:57:43 dovecot_login authenticator failed for ([117.6.226.122]) [117.6.226.122]:49274: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 09:57:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<opkJA95DnsQtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.152.206.155
country_id: 1814991
description:
2025-11-18 09:57:12 dovecot_login authenticator failed for ([219.152.206.155]) [219.152.206.155]:49822: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-11-18 09:57:14 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:50784: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.251.90
country_id: 1269750
description:
2025-11-18 09:57:17 dovecot_login authenticator failed for ([125.17.198.105]) [125.19.251.90]:43514: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HUnSAd5DDJKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.145.62
country_id: 1835841
description:
2025-11-18 09:57:54 dovecot_login authenticator failed for ([125.140.145.62]) [125.140.145.62]:54095: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.161
country_id: 2186224
description:
2025-11-18 09:59:04 dovecot_login authenticator failed for ([121.73.169.161]) [121.73.169.161]:56030: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JWdjBd5DLLGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 09:58:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<3L4HBt5DPsivfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 09:58:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<uJpiBt5DKoRrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.227.245.154
country_id: 690791
description:
2025-11-18 09:58:52 dovecot_login authenticator failed for (213-227-245-154.static.vega-ua.net) [213.227.245.154]:31984: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 09:58:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<7rObBt5DKMYtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 09:58:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<OlIMBN5Djs5AF/Qn>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:59:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ILoxB95DZruxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2025-11-18 09:58:46 dovecot_login authenticator failed for ([65.20.133.56]) [65.20.133.56]:46580: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-11-18 09:58:48 dovecot_login authenticator failed for ([182.79.95.231]) [152.52.244.46]:52868: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 09:58:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<UwNbBt5DUeR3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 09:58:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<Odd0Bt5DWqml0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2025-11-18 09:59:01 dovecot_login authenticator failed for 111-70-32-10.emome-ip.hinet.net [111.70.32.10]:39540: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.178.82.215
country_id: 1814991
description:
2025-11-18 09:58:35 dovecot_login authenticator failed for ([61.178.82.215]) [61.178.82.215]:52457: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 18 09:58:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<lmDEBd5Dospn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.201.160.53
country_id: 290557
description:
2025-11-18 09:58:43 dovecot_login authenticator failed for ([87.201.160.53]) [87.201.160.53]:34210: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 09:59:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EAkACd5DaMuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.43.42
country_id: 2017370
description:
2025-11-18 09:59:44 dovecot_login authenticator failed for ([188.247.43.42]) [188.247.43.42]:46306: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-11-18 09:59:52 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:14500: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 09:59:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<znLqB95D5JYnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.244.34
country_id: 1269750
description:
2025-11-18 09:59:35 dovecot_login authenticator failed for ([128.185.224.14]) [122.186.244.34]:56270: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 09:59:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<QyWyCd5DirSkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.76.73.4
country_id: 1814991
description:
2025-11-18 10:00:00 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:32681: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 18 10:00:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<Tz34Dd5DAGIkMrGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 10:00:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<FmRNDN5Dwq5A44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<itSODN5DIu6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 10:00:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<M7zzDN5DTJtSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.222.188.154
country_id: 1814991
description:
2025-11-18 10:00:51 dovecot_login authenticator failed for ([58.222.188.154]) [58.222.188.154]:57027: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
country_id: 1819730
description:
2025-11-18 10:01:55 dovecot_login authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:63669: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:02:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KfHsEd5DYKaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.210.192.240
country_id: 3144096
description:
2025-11-18 10:01:17 dovecot_login authenticator failed for ([84.210.192.240]) [84.210.192.240]:35966: 535 Incorrect authentication data (set_id=flavio.oliveira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 10:01:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<3IrkD95DPuYnaoFh>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Fj4eEN5D8pWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 162.0.224.38
country_id: 6252001
description:
Nov 18 10:01:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@prolip.com.br>, method=PLAIN, rip=162.0.224.38, lip=200.150.196.245, session=<7Gk9EN5DwI2iAOAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.15.69
country_id: 3469034
description:
2025-11-18 10:02:59 dovecot_login authenticator failed for (177-174-15-89.user.vivozap.com.br) [177.174.15.69]:39049: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.111.2
country_id: 1562822
description:
2025-11-18 10:03:03 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.111.2]:38354: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.183.102.189
country_id: 6252001
description:
2025-11-18 10:02:14 dovecot_login authenticator failed for ([75.183.102.189]) [75.183.102.189]:40278: 535 Incorrect authentication data (set_id=juridico)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JECsE95DzLCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 10:02:35 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:61169: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.194
country_id: 1269750
description:
2025-11-18 10:02:44 dovecot_login authenticator failed for ([182.95.54.194]) [182.95.54.194]:60578: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.25.183
country_id: 298795
description:
2025-11-18 10:03:51 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:55876: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 10:04:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@pousadarincaoalegre.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<G2WrGN5DjMNzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.201.2.253
country_id: 1814991
description:
2025-11-18 10:03:14 dovecot_login authenticator failed for ([113.201.2.253]) [113.201.2.253]:18925: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 10:03:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<151BFt5D7pwI2Cjk>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5ZpFF95DEMuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.41.6
country_id: 1814991
description:
2025-11-18 10:03:40 dovecot_login authenticator failed for ([219.139.41.6]) [219.139.41.6]:49566: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-11-18 10:03:27 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:51783: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.62.42
country_id: 1814991
description:
2025-11-18 10:03:13 dovecot_login authenticator failed for ([111.26.62.42]) [111.26.62.42]:58820: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.201.27.64
country_id: 2029969
description:
2025-11-18 10:03:17 dovecot_login authenticator failed for ([122.201.27.64]) [122.201.27.64]:53914: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.38.45.85
country_id: 2802361
description:
Nov 18 10:03:20 hosting pure-ftpd: (?@34.38.45.85) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.51.135
country_id: 3144096
description:
2025-11-18 10:04:14 dovecot_login authenticator failed for (cm-178.232.51.135.get.no) [178.232.51.135]:33026: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 10:04:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@iemif.org>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<RrJtGt5DOJiUcQQF>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<K/nUGt5DwOSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 10:04:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<at3rG95DvNqP9IUv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:05:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<m9OfHN5DlIOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.88
country_id: 1814991
description:
2025-11-18 10:04:12 dovecot_login authenticator failed for ([27.24.141.88]) [27.24.141.88]:58842: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-11-18 10:04:23 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:41876: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.91.50
country_id: 1269750
description:
2025-11-18 10:04:26 dovecot_login authenticator failed for ([122.186.91.50]) [122.186.91.50]:59274: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 10:04:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<sKJeGt5D3sHBl4nP>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.187.56
country_id: 1819730
description:
Nov 18 10:04:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=129.226.187.56, lip=200.150.196.245, session=<Q9XcGt5Doq2B4rs4>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.33.76
country_id: 6252001
description:
2025-11-18 10:04:55 dovecot_login authenticator failed for ([65.76.33.76]) [65.76.33.76]:48674: 535 Incorrect authentication data (set_id=novamanha)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 10:04:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<NYcRGt5DZuUO4dKR>


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 201.22.53.135
country_id: 3469034
description:
Nov 18 10:05:08 hosting pure-ftpd: (opsconso@201.22.53.135) [NOTICE] /home/opsconso//public_html/wp-content/themes/ops/template-cartas.php uploaded  (8212 bytes, 30859.04KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2025-11-18 10:05:07 dovecot_login authenticator failed for 079.33.246.220.static.netvigator.com [220.246.33.79]:54148: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 10:04:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@alcantaraemonteiro.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<v8uQG95DYMZ2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.196.119
country_id: 1814991
description:
2025-11-18 10:04:21 dovecot_login authenticator failed for ([123.129.196.119]) [123.129.196.119]:56808: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.199.10.82
country_id: 3175395
description:
2025-11-18 10:04:44 dovecot_login authenticator failed for host-31-199-10-82.business.telecomitalia.it [31.199.10.82]:55275: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.162.117
country_id: 2017370
description:
2025-11-18 10:04:10 dovecot_login authenticator failed for broadband-77-37-162-117.ip.moscow.rt.ru [77.37.162.117]:45826: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 18 10:05:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<vwYQHd5DeK5ns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-18 10:05:14 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:61348: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-18 10:05:13 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:47729: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<LpBzHt5DmI6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 10:05:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<+fmtHt5DJOCkXF7M>


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 201.22.53.135
country_id: 3469034
description:
Nov 18 10:05:40 hosting pure-ftpd: (opsconso@201.22.53.135) [NOTICE] /home/opsconso//public_html/wp-content/themes/ops/template-cartas.php uploaded  (5074 bytes, 1350.17KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.19.165.201
country_id: 3469034
description:
2025-11-18 10:06:38 dovecot_plain authenticator failed for (ASMAQ-lyxY) [149.19.165.201]:43794: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2025-11-18 10:06:58 dovecot_login authenticator failed for (185-183-103-121.xdsl.5gdsl.com) [185.183.103.121]:57988: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.238.254.156
country_id: 2661886
description:
2025-11-18 10:06:58 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se [213.238.254.156]:35432: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 10:07:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<seOrI95D7NJSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.178.82.215
country_id: 1814991
description:
2025-11-18 10:07:08 dovecot_login authenticator failed for ([61.178.82.215]) [61.178.82.215]:55727: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NY0GIt5DoKmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-11-18 10:06:34 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:48438: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2025-11-18 10:06:38 dovecot_login authenticator failed for ([14.46.58.104]) [14.46.58.104]:59568: 535 Incorrect authentication data (set_id=juliana@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-11-18 10:06:52 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:51592: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.11.252.160
country_id: 3469034
description:
2025-11-18 10:07:20 dovecot_login authenticator failed for (187-11-252-160.dsl.telesp.net.br) [187.11.252.160]:57290: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<CzaWJd5DRMaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-18 10:07:49 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:55828: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2025-11-18 10:07:54 dovecot_login authenticator failed for 82-209-148-60.cust.bredband2.com [82.209.148.60]:50336: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:08:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cSZiJ95DMNCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.188.117
country_id: 294640
description:
2025-11-18 10:07:09 dovecot_login authenticator failed for (82-102-188-117.orange.net.il) [82.102.188.117]:40267: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2025-11-18 10:07:09 dovecot_login authenticator failed for (m121-202-206-119.smartone.com) [121.202.206.119]:48962: 535 Incorrect authentication data (set_id=juliana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.207.181.124
country_id: 2017370
description:
2025-11-18 10:07:29 dovecot_login authenticator failed for ([91.207.181.124]) [91.207.181.124]:41872: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 10:07:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<hU4+Jt5DKsGl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.222
country_id: 1814991
description:
2025-11-18 10:07:48 dovecot_login authenticator failed for ([1.31.80.222]) [1.31.80.222]:45882: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-18 10:08:39 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:56492: 535 Incorrect authentication data (set_id=bruno)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.166.87.145
country_id: 1814991
description:
2025-11-18 10:08:46 dovecot_login authenticator failed for ([223.166.87.145]) [223.166.87.145]:45442: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 10:08:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<6XWvJ95DUJQI1et7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.138.179
country_id: 1269750
description:
2025-11-18 10:08:13 dovecot_login authenticator failed for ([103.158.138.179]) [103.158.138.179]:43306: 535 Incorrect authentication data (set_id=bruno)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.75.92.136
country_id: 1814991
description:
2025-11-18 10:08:13 dovecot_login authenticator failed for ([159.75.92.136]) [159.75.92.136]:43288: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.76.191.29
country_id: 1819730
description:
2025-11-18 10:08:27 dovecot_login authenticator failed for 029.191.76.219.static.netvigator.com [219.76.191.29]:53156: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:08:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HuovKd5DtN2xV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lve2LN5DOomxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.194.132
country_id: 2017370
description:
2025-11-18 10:09:53 dovecot_login authenticator failed for (79x136x194x132.dynamic.saratov.ertelecom.ru) [79.136.194.132]:56572: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 10:09:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dradienecougo.com>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<KmmQK95DAuWUcQQF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.81.25.86
country_id: 1819730
description:
2025-11-18 10:09:25 dovecot_login authenticator failed for (161.81.25.86.hk.chinamobile.com) [161.81.25.86]:60485: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:11:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<oP4ZMt5DLrCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.222.177.146
country_id: 6252001
description:
2025-11-18 10:11:08 dovecot_login authenticator failed for ([12.222.177.146]) [12.222.177.146]:61264: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 18 10:10:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<gxTPLt5DzrB57bKF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.220.16.46
country_id: 1835841
description:
2025-11-18 10:10:09 dovecot_login authenticator failed for ([119.220.16.46]) [119.220.16.46]:56620: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.104
country_id: 3469034
description:
2025-11-18 10:10:29 H=(localhost) [179.0.178.104]:63174 F=<postmaster@mail.com> rejected RCPT <vanessalima@louvoreterno.com.br>: Nenhuma pessoa no endereço."


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tstSMN5DKqWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.167.70.202
country_id: 1861060
description:
2025-11-18 10:10:38 dovecot_login authenticator failed for os3-365-15698.vs.sakura.ne.jp (ADMIN) [133.167.70.202]:59617: 535 Incorrect authentication data (set_id=info@kglsolucoes.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.244.44
country_id: 2017370
description:
2025-11-18 10:11:17 dovecot_login authenticator failed for ([95.181.244.44]) [95.181.244.44]:50682: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DozgM95DYsGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 10:11:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fernandotonet.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<L+PmM95DMK12wSaf>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 216.238.113.176
country_id: 3469034
description:
Nov 18 10:11:48 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=216.238.113.176, lip=200.150.196.245, session=</X/dNN5DT/TY7nGw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.205.20.70
country_id: 6251999
description:
2025-11-18 10:11:59 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:56126: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.220.14.49
country_id: 1269750
description:
2025-11-18 10:11:24 dovecot_login authenticator failed for (static.ftth.knl.117.220.14.49.bsnl.in) [117.220.14.49]:37672: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.199.161.79
country_id: 597427
description:
2025-11-18 10:11:35 dovecot_login authenticator failed for ip-5-199-161-79.010.ptr.cherryservers.net [5.199.161.79]:54508: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 159.223.33.152
country_id: 1880251
description:
[2025-11-18 10:11:39 -0300] info [cpaneld] 159.223.33.152 - fundamen "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2025-11-18 10:11:47 dovecot_plain authenticator failed for (chabloness) [65.20.133.208]:46996: 535 Incorrect authentication data (set_id=design.user.sales@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 216.238.113.176
country_id: 3469034
description:
Nov 18 10:11:48 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=216.238.113.176, lip=200.150.196.245, TLS, session=<6CDcNN5DR/TY7nGw>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 10:12:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<CIyWNt5DlsBw2eny>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 10:12:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=</K5EN95DWLnSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.86.13
country_id: 3996063
description:
2025-11-18 10:12:07 dovecot_login authenticator failed for (201.173.86.13-clientes-izzi.mx) [201.173.86.13]:52255: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mNFzN95DNtWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 10:12:41 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:59142: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.85.118.147
country_id: 1814991
description:
2025-11-18 10:12:43 dovecot_login authenticator failed for ([111.85.118.147]) [111.85.118.147]:47165: 535 Incorrect authentication data (set_id=recepcao)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 10:13:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<aN5UOd5D3sbBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-18 10:12:24 dovecot_login authenticator failed for (ministeriofernandabrum.com.br) [112.122.54.54]:19860: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 10:14:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<sYvYPN5DMpYv7PP+>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 10:13:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<2bL3Od5DbLCl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 18 10:13:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<57SfOt5DNpiGx8nN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cq0PO95DooexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 10:14:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<BzqxPN5DMs53xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-18 10:14:01 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:51530: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<As5sQN5DgrWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 10:14:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<VESgPd5DRNtA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-18 10:14:22 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:52126: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SvudPt5DUqqxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Ei0sQt5DoMaxV3kv>


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 46.62.209.187
country_id: 660013
description:
Nov 18 10:15:50 hosting pure-ftpd: (?@46.62.209.187) [WARNING] Authentication failed for user [cartoriopinheirinho]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-11-18 10:16:03 dovecot_login authenticator failed for ([65.191.211.33]) [65.191.211.33]:50344: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 46.62.209.187
country_id: 660013
description:
Nov 18 10:16:17 hosting pure-ftpd: (?@46.62.209.187) [WARNING] Authentication failed for user [cartoriopinheirinho]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.51.252.26
country_id: 1814991
description:
2025-11-18 10:16:34 dovecot_login authenticator failed for ([122.139.16.200]) [119.51.252.26]:28060: 535 Incorrect authentication data (set_id=flavio.oliveira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.92.36
country_id: 1814991
description:
2025-11-18 10:16:36 dovecot_login authenticator failed for ([36.135.92.35]) [36.135.92.36]:47610: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2025-11-18 10:16:40 dovecot_login authenticator failed for (ip-arana.net.id.as132673) [103.90.27.83]:38546: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.252
country_id: 1668284
description:
2025-11-18 10:16:09 dovecot_login authenticator failed for 111-70-23-252.emome-ip.hinet.net [111.70.23.252]:54295: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.54
country_id: 1269750
description:
2025-11-18 10:16:33 dovecot_login authenticator failed for ([128.185.254.54]) [128.185.254.54]:40078: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 46.62.209.187
country_id: 660013
description:
Nov 18 10:16:07 hosting pure-ftpd: (?@46.62.209.187) [WARNING] Authentication failed for user [cartoriopinheirinho]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.40.82
country_id: 2017370
description:
2025-11-18 10:16:16 dovecot_login authenticator failed for ([46.44.40.82]) [46.44.40.82]:51386: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WwTLRd5DBt6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 10:16:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<lfQzR95DcJnSchJs>


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 46.62.209.187
country_id: 660013
description:
Nov 18 10:16:33 hosting pure-ftpd: (?@46.62.209.187) [WARNING] Authentication failed for user [cartoriopinheirinho]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 10:16:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<IqcDR95Diug+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.196.119
country_id: 1814991
description:
2025-11-18 10:16:56 dovecot_login authenticator failed for ([123.129.196.119]) [123.129.196.119]:51138: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.182.73.132
country_id: 1835841
description:
2025-11-18 10:17:00 dovecot_login authenticator failed for ([210.182.73.132]) [210.182.73.132]:58401: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 10:17:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<rMdxSd5DFuHBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-11-18 10:17:50 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:38906: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.6.99
country_id: 1814991
description:
2025-11-18 10:17:28 dovecot_login authenticator failed for ([61.169.6.99]) [61.169.6.99]:39094: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:17:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SFNfSd5D8IqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-11-18 10:17:38 dovecot_plain authenticator failed for (quitiopars) [64.72.74.162]:37520: 535 Incorrect authentication data (set_id=design.user.support@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 10:17:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<hLKZSt5DQK1SnOdL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:18:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<jZwpS95DKpmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2025-11-18 10:18:03 dovecot_login authenticator failed for ([128.185.18.217]) [122.185.176.126]:51204: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.194.94
country_id: 1269750
description:
2025-11-18 10:17:29 dovecot_login authenticator failed for ([27.123.91.196]) [152.52.194.94]:46434: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
country_id: 1835841
description:
2025-11-18 10:17:52 dovecot_login authenticator failed for ([182.227.214.33]) [182.227.214.33]:48154: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-11-18 10:17:57 dovecot_login authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:60650: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-11-18 10:18:00 dovecot_login authenticator failed for (189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:43865: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.254.228.161
country_id: 2017370
description:
2025-11-18 10:17:08 dovecot_login authenticator failed for line161-37.adsl.kirov.ru [89.254.228.161]:51119: 535 Incorrect authentication data (set_id=flavio.oliveira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 10:17:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<5BfUSt5DvtWB4kCN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 10:17:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<BFv8SN5DVsckMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.121.234.5
country_id: 1814991
description:
2025-11-18 10:18:44 dovecot_login authenticator failed for ([118.121.233.158]) [118.121.234.5]:43928: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 10:18:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<+xgITt5Dzs1zR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
country_id: 1819730
description:
2025-11-18 10:18:10 dovecot_login authenticator failed for ([180.188.143.166]) [180.188.143.166]:57382: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.249.20.14
country_id: 1814991
description:
2025-11-18 10:18:19 dovecot_login authenticator failed for ([140.249.20.14]) [140.249.20.14]:53518: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KTPtTN5DFKuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.216.150.69
country_id: 6252001
description:
2025-11-18 10:18:33 dovecot_login authenticator failed for 67-216-150-67-216-150-69.cpe.sparklight.net [67.216.150.69]:43751: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.128.55.94
country_id: 1814991
description:
2025-11-18 10:18:17 dovecot_login authenticator failed for ([219.128.55.94]) [219.128.55.94]:33749: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.129.34.91
country_id: 1835841
description:
2025-11-18 10:18:18 dovecot_login authenticator failed for ([121.129.34.91]) [121.129.34.91]:56324: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-11-18 10:19:19 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:32066: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 10:19:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<rifoT95DStItPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.83
country_id: 798544
description:
2025-11-18 10:19:31 dovecot_login authenticator failed for (Copy-of-VM-2022) [185.241.208.83]:62366: 535 Incorrect authentication data (set_id=jotadeschamps@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-18 10:19:44 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:57934: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.76.73.4
country_id: 1814991
description:
2025-11-18 10:20:02 dovecot_login authenticator failed for ([218.76.73.4]) [218.76.73.4]:58158: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 10:19:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<7DXLT95DcodSczCz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</rZ6UN5DzMKxV3kv>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-18 10:19:41 H=(195.3.134.135) [179.0.178.53]:62685 F=<erictremblaysi@hotmail.com> rejected RCPT <toninho@cruzeirosgospel.com.br>: No Such User Here


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 10:20:08 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52289: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 10:20:30 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55475: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BiMZVN5DGNqxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vvHeVd5DJOuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 10:21:34 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:58375: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.142.48.143
country_id: 2017370
description:
2025-11-18 10:21:50 dovecot_login authenticator failed for (213.142.48.143-FTTB.planeta.tc) [213.142.48.143]:56022: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 10:21:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<MmfbWN5DgrcXXz9j>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-18 10:21:13 H=(195.3.134.135) [179.0.178.53]:64843 F=<erictremblaysi@hotmail.com> rejected RCPT <lmazzali@transol.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:64843 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UtuoV95DPoaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 10:23:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<mnH7XN5DMpyl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.164.76
country_id: 2661886
description:
2025-11-18 10:22:15 dovecot_login authenticator failed for ip076.net-81-16-164.koping.net [81.16.164.76]:42832: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-11-18 10:22:21 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:37008: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2025-11-18 10:22:24 dovecot_login authenticator failed for 208-96-233-67.resi.cgocable.ca [208.96.233.67]:47256: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:22:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+fRAW95DTqGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.250
country_id: 2186224
description:
2025-11-18 10:22:39 dovecot_login authenticator failed for ([121.73.163.250]) [121.73.163.250]:43636: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 10:22:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<pNuCW95DaohCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-11-18 10:23:25 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:51738: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.188
country_id: 3996063
description:
2025-11-18 10:23:40 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:40658: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.3.36.154
country_id: 298795
description:
2025-11-18 10:23:47 dovecot_login authenticator failed for (95.3.36.154.static.ttnet.com.tr) [95.3.36.154]:37918: 535 Incorrect authentication data (set_id=vendas@arkson.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 10:23:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<qG74X95DxORA44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<p1WWYN5DDs6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 10:23:24 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:49159: 535 Incorrect authentication data (set_id=info@jacgeneralcleaning.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-11-18 10:23:25 dovecot_login authenticator failed for (static.ftth.btd.59.99.153.21.bsnl.in) [59.99.153.21]:37035: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hzjJXt5DALuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.40.82
country_id: 2017370
description:
2025-11-18 10:24:09 dovecot_login authenticator failed for ([46.44.40.82]) [46.44.40.82]:51394: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2025-11-18 10:24:44 dovecot_login authenticator failed for ([218.22.187.67]) [218.22.187.66]:57023: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.163.5
country_id: 2017370
description:
2025-11-18 10:24:47 dovecot_login authenticator failed for (pool-176-226-163-5.is74.ru) [176.226.163.5]:54658: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 10:24:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<tAxVY95Djox3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.59.206.224
country_id: 1814991
description:
2025-11-18 10:24:08 dovecot_login authenticator failed for ([111.59.206.224]) [111.59.206.224]:52183: 535 Incorrect authentication data (set_id=vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 10:24:11 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51586: 535 Incorrect authentication data (set_id=cadastro@asscar.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<iatlYt5DkNuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.209.146
country_id: 2017370
description:
2025-11-18 10:24:57 dovecot_login authenticator failed for ([88.84.209.146]) [88.84.209.146]:51108: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-18 10:25:07 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:56085: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 148.113.4.5
country_id: 1269750
description:
Nov 18 10:25:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@betmetalurgica.com.br>, method=PLAIN, rip=148.113.4.5, lip=200.150.196.245, session=<Ba94Zd5Dxr6UcQQF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 10:25:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<ZUFuZd5D+s1xoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.70
country_id: 1269750
description:
2025-11-18 10:26:07 dovecot_login authenticator failed for ([182.66.80.41]) [182.66.214.70]:34978: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-18 10:25:30 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:59177: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TF/zZd5DxI2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.222.178
country_id: 1269750
description:
2025-11-18 10:25:40 dovecot_login authenticator failed for ([182.95.222.178]) [182.95.222.178]:38214: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 10:25:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@partnerscapital.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<PQggZt5DWIuB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.46.148.53
country_id: 1605651
description:
2025-11-18 10:25:13 dovecot_login authenticator failed for 119-46-148-53.static.asianet.co.th [119.46.148.53]:33705: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-11-18 10:25:29 dovecot_login authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:49218: 535 Incorrect authentication data (set_id=leandro@eloempresas.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 10:25:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@f5assessoria.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<8scfZt5DpJt2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.225.255.82
country_id: 2510769
description:
2025-11-18 10:25:13 dovecot_login authenticator failed for (82.red.255.225.212.procono.es) [212.225.255.82]:35289: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.201.11
country_id: 1168579
description:
2025-11-18 10:25:44 dovecot_login authenticator failed for (static.khi77.pie.net.pk) [221.120.201.11]:52869: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-11-18 10:25:53 dovecot_login authenticator failed for (136-53-199-160.googlefiber.net) [136.53.199.160]:47438: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-11-18 10:26:31 dovecot_login authenticator failed for ([46.212.39.201]) [46.212.39.201]:50787: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.129
country_id: 3686110
description:
2025-11-18 10:26:44 dovecot_login authenticator failed for (azteca-comunicaciones.com) [186.179.100.129]:1113: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 10:26:50 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:54346: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:27:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<44RZa95DHLuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2025-11-18 10:26:19 dovecot_login authenticator failed for ([211.53.58.1]) [211.169.212.206]:51840: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 10:26:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<aGoSad5DyF+vfiX3>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qaWLad5DBK+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.188
country_id: 3996063
description:
2025-11-18 10:26:59 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:55264: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 10:28:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@toromartelinho.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<IkELb95D4NxzR+4E>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 10:27:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<uJvwa95DFKotPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 10:27:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<m8YrbN5DMsgv+yzS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 10:27:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@f5assessoria.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<rRpdbN5D2tqkXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
country_id: 2017370
description:
2025-11-18 10:27:24 dovecot_login authenticator failed for (22.69.85.194.in-addr.arpa) [194.85.69.22]:57746: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-11-18 10:27:36 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:44416: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.97.10
country_id: 1814991
description:
2025-11-18 10:27:54 dovecot_login authenticator failed for ([116.114.97.10]) [116.114.97.10]:33401: 535 Incorrect authentication data (set_id=desenvolvimento2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.184.193.67
country_id: 6252001
description:
2025-11-18 10:27:24 dovecot_login authenticator failed for ([157.230.66.74]) [137.184.193.67]:57710: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9bEWbd5DsMixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 10:27:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<QhVnbd5Dkuk7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.104.175
country_id: 2017370
description:
2025-11-18 10:27:47 dovecot_login authenticator failed for broadband-188-32-104-175.ip.moscow.rt.ru [188.32.104.175]:60566: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.225.114
country_id: 1269750
description:
2025-11-18 10:28:07 dovecot_login authenticator failed for ([128.185.247.231]) [182.95.225.114]:42518: 535 Incorrect authentication data (set_id=novamanha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.37.16
country_id: 390903
description:
2025-11-18 10:27:11 dovecot_login authenticator failed for (149-210-37-16.mobile.nym.cosmote.net) [149.210.37.16]:60634: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 10:27:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<gNL4bN5Deth9gnHM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 10:27:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<bvV9bt5D6u1AF/Qn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 10:28:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<5Rwyb95DJvtxoZB3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lUmocN5DdumxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2025-11-18 10:28:59 dovecot_login authenticator failed for ([61.37.150.35]) [61.37.150.6]:20676: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-11-18 10:29:05 dovecot_login authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:50204: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2025-11-18 10:29:07 dovecot_plain authenticator failed for c-73-144-27-228.hsd1.mi.comcast.net (courni) [73.144.27.228]:42512: 535 Incorrect authentication data (set_id=design.user.admin@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 10:28:37 dovecot_login authenticator failed for (User) [177.74.174.120]:54404: 535 Incorrect authentication data (set_id=juliana@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-11-18 10:28:44 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:59526: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 18 10:28:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<uKAact5DDt6dQi/y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 18 10:29:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<i3SCdN5DQm2317Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.111.249.76
country_id: 2017370
description:
2025-11-18 10:30:01 dovecot_login authenticator failed for pppoe-78-111-249-76.dynamic.tvingo.ru [78.111.249.76]:40242: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EigNdt5D4K6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 10:29:10 dovecot_login authenticator failed for (User) [177.74.174.120]:54404: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.15.228
country_id: 1168579
description:
2025-11-18 10:29:15 dovecot_login authenticator failed for ([45.194.15.228]) [45.194.15.228]:34227: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.101.241.44
country_id: 1835841
description:
2025-11-18 10:29:19 dovecot_login authenticator failed for ([222.101.241.44]) [222.101.241.44]:49737: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 216.238.113.176
country_id: 3469034
description:
Nov 18 10:29:21 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=216.238.113.176, lip=200.150.196.245, TLS, session=<TvCgc95DXs7Y7nGw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.62.50.36
country_id: 298795
description:
2025-11-18 10:29:30 dovecot_login authenticator failed for (dynamic-195-62-50-36.cgnat.wi.hiperonline.com.tr) [195.62.50.36]:41001: 535 Incorrect authentication data (set_id=flavio.oliveira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.140.230
country_id: 1814991
description:
2025-11-18 10:29:17 dovecot_login authenticator failed for ([218.56.121.58]) [221.2.140.230]:59538: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dvA8dN5DXKGxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:30:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<sy3dd95DQsKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.253.86
country_id: 1269750
description:
2025-11-18 10:30:57 dovecot_login authenticator failed for ([125.20.253.86]) [125.20.253.86]:50928: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.253.242
country_id: 3382998
description:
2025-11-18 10:31:04 dovecot_login authenticator failed for ([186.179.253.242]) [186.179.253.242]:45169: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 10:30:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@primiciapersianas.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<pquvd95DwJCkXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 18 10:30:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<ZbyQdN5DZoQIiXsk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.245.250.16
country_id: 6252001
description:
2025-11-18 10:30:23 dovecot_login authenticator failed for ([173.245.250.16]) [173.245.250.16]:43338: 535 Incorrect authentication data (set_id=recepcao)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.85.150.173
country_id: 3923057
description:
2025-11-18 10:30:44 dovecot_login authenticator failed for (static-200-85-150173.vnet.bo) [200.85.150.173]:48852: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.232.167
country_id: 2017370
description:
2025-11-18 10:30:56 dovecot_login authenticator failed for ([95.221.232.167]) [95.221.232.167]:52768: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 10:30:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<qsehdt5Dapho7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2025-11-18 10:31:36 dovecot_login authenticator failed for (c-50-187-155-130.unallocated.comcastbusiness.net) [50.187.155.130]:40123: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.238
country_id: 1835841
description:
2025-11-18 10:31:45 dovecot_login authenticator failed for ([210.206.24.238]) [210.206.24.238]:14659: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.74.212.17
country_id: 1835841
description:
2025-11-18 10:32:00 dovecot_login authenticator failed for ([61.74.212.17]) [61.74.212.17]:1769: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 10:31:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<6c0Uet5DGsRrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-11-18 10:31:36 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:46184: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-18 10:31:24 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (posint) [87.103.126.54]:32245: 535 Incorrect authentication data (set_id=design.user.ceo@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kiJse95D8N2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2025-11-18 10:31:42 dovecot_login authenticator failed for ([106.245.246.26]) [106.245.246.26]:34114: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-11-18 10:31:48 dovecot_login authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:32526: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-11-18 10:31:52 dovecot_login authenticator failed for ([125.19.165.242]) [125.19.188.98]:43322: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2025-11-18 10:31:16 dovecot_login authenticator failed for ([61.72.58.242]) [61.72.58.242]:34755: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2025-11-18 10:31:21 dovecot_plain authenticator failed for (caliting) [5.32.107.6]:54290: 535 Incorrect authentication data (set_id=design.user.ceo@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 10:32:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fernandotonet.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<2dBoft5DkKikXLll>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DZ/HgN5DiqaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2025-11-18 10:32:08 dovecot_login authenticator failed for ([121.134.31.193]) [121.134.31.193]:50879: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.164.164.9
country_id: 1835841
description:
2025-11-18 10:32:16 dovecot_login authenticator failed for ([121.164.164.9]) [121.164.164.9]:49819: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 10:32:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<CmtJft5DPLtCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-11-18 10:32:24 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:36716: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Q5gBf95DKpGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 10:32:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<Vk5cf95DirF9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-18 10:32:48 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:41000: 535 Incorrect authentication data (set_id=info@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 10:33:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<r0Jjgt5DzsFo7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BOSKgt5DmrmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-11-18 10:33:11 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:58391: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 10:33:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<uwhGgt5D0Nkv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 10:34:17 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52068: 535 Incorrect authentication data (set_id=contato@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.244
country_id: 1814991
description:
2025-11-18 10:34:32 dovecot_login authenticator failed for ([111.61.176.244]) [111.61.176.244]:26446: 535 Incorrect authentication data (set_id=info@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2025-11-18 10:34:37 dovecot_login authenticator failed for (103.51.26.198.sukaininfoway.com) [103.51.26.198]:35203: 535 Incorrect authentication data (set_id=info@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.88.184
country_id: 1668284
description:
2025-11-18 10:34:40 dovecot_login authenticator failed for 110-25-88-184.adsl.fetnet.net [110.25.88.184]:59250: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
country_id: 1835841
description:
2025-11-18 10:34:44 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:35714: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-18 10:34:51 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:32885: 535 Incorrect authentication data (set_id=recepcao)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.245.34
country_id: 2017370
description:
2025-11-18 10:34:54 dovecot_login authenticator failed for ([46.8.245.34]) [46.8.245.34]:44612: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 10:34:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<qK7Xhd5DSJhvAEul>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xnUnht5DvtaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-18 10:34:40 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:47718: 535 Incorrect authentication data (set_id=recepcao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2025-11-18 10:34:44 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.49.14]:38894: 535 Incorrect authentication data (set_id=info@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
country_id: 1643084
description:
2025-11-18 10:35:04 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:60260: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 10:35:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@oabsjp.org.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<vCZ3id5DDop2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
country_id: 1814991
description:
2025-11-18 10:35:56 dovecot_login authenticator failed for ([111.61.177.187]) [111.61.177.187]:65296: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 10:36:00 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:63835: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Tg6Gi95DTpuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-18 10:36:05 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:65145: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-18 10:35:11 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:9526: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2025-11-18 10:35:12 dovecot_login authenticator failed for ([60.172.230.184]) [60.172.230.184]:38465: 535 Incorrect authentication data


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DPi1id5DqoaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-11-18 10:35:45 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:48030: 535 Incorrect authentication data (set_id=info@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
country_id: 2017370
description:
2025-11-18 10:35:51 dovecot_login authenticator failed for ([185.15.189.232]) [185.15.189.232]:44208: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2025-11-18 10:35:26 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:51408: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.168.190
country_id: 1814991
description:
2025-11-18 10:35:29 dovecot_login authenticator failed for (pc0.zz.ha.cn) [218.28.168.190]:47780: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.192.79.179
country_id: 3865483
description:
2025-11-18 10:36:11 dovecot_login authenticator failed for (pppoe-179.79.192.181.in-addr.arpa) [181.192.79.179]:38822: 535 Incorrect authentication data


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 10:36:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<Gh7ojd5DHustPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 10:37:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<E9xAj95D7oh3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 18 10:36:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<1UkzjN5DXq0vT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2025-11-18 10:36:29 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:50502: 535 Incorrect authentication data (set_id=info@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2025-11-18 10:36:30 dovecot_login authenticator failed for ([121.128.76.108]) [211.196.31.2]:41259: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Ss1Jjd5DTKuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2025-11-18 10:36:47 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:46753: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.21.148
country_id: 1835841
description:
2025-11-18 10:36:51 dovecot_login authenticator failed for ([221.167.21.148]) [221.167.21.148]:45024: 535 Incorrect authentication data (set_id=info@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-18 10:37:05 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:54698: 535 Incorrect authentication data (set_id=info@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-11-18 10:37:07 dovecot_login authenticator failed for ([186.239.41.74]) [186.239.41.74]:42252: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:37:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<denlkN5DUsqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 10:37:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<5lx0kd5D8I0tPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 10:37:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@prolip.com.br>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<dQa2kd5DcI2P9IUv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
country_id: 1819730
description:
2025-11-18 10:37:51 dovecot_login authenticator failed for (223-197-166-78.static.imsbiz.com) [223.197.166.78]:61259: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2025-11-18 10:37:17 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:56722: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 10:37:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<xyd1kN5DmJ1AF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.19.12
country_id: 3144096
description:
2025-11-18 10:37:27 dovecot_login authenticator failed for (cm-84.211.19.12.get.no) [84.211.19.12]:51974: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-18 10:38:40 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:45602: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<f+A3lt5DTISxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.244.44
country_id: 2017370
description:
2025-11-18 10:38:24 dovecot_login authenticator failed for ([95.181.244.44]) [95.181.244.44]:59454: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<B9l1lN5DhuOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.154.158
country_id: 1269750
description:
2025-11-18 10:38:45 dovecot_login authenticator failed for ([125.19.154.158]) [125.19.154.158]:32850: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 10:38:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<LuHold5DDqqkXF7M>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 10:39:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<my0Ylt5DEOdrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-11-18 10:38:30 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:59776: 535 Incorrect authentication data (set_id=info@vidaengenharia.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 10:38:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<MTW2lN5DKNNCYSpH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1MYEmN5Dxo+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 10:39:43 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:51900: 535 Incorrect authentication data (set_id=curitiba@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-11-18 10:39:44 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:40774: 535 Incorrect authentication data (set_id=info@letracaixa.art.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.0.75.165
country_id: 1814991
description:
Nov 18 10:39:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=111.0.75.165, lip=200.150.196.245, session=<phLGmN5DkqJvAEul>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Nov 18 10:39:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=<Yl/7mN5DVt7BHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 10:39:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<4ecimd5DCe13xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-11-18 10:39:56 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:48892: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<S0aVm95DoLCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-11-18 10:40:36 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:38994: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.214.78
country_id: 1269750
description:
2025-11-18 10:40:39 dovecot_login authenticator failed for ([128.185.39.145]) [128.185.214.78]:36132: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.172.182
country_id: 3469034
description:
2025-11-18 10:40:17 dovecot_login authenticator failed for ([200.216.172.182]) [200.216.172.182]:33303: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-11-18 10:40:24 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:52458: 535 Incorrect authentication data (set_id=info@vidaengenharia.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TxLyoN5DwNuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 10:41:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@highqualityautoparts.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<Zvfhnd5DRN8+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.124.17
country_id: 1512440
description:
2025-11-18 10:41:36 dovecot_login authenticator failed for (17.64.uzpak.uz) [213.230.124.17]:56192: 535 Incorrect authentication data (set_id=info@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-11-18 10:41:42 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:50644: 535 Incorrect authentication data (set_id=info@educacionalevangelico.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2025-11-18 10:41:51 dovecot_login authenticator failed for ([121.160.166.161]) [121.160.166.161]:53986: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-11-18 10:42:04 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:44078: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 10:41:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<O/nlnt5D1pqvfiX3>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ueMqn95DlNGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
country_id: 3996063
description:
2025-11-18 10:41:52 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:59425: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-18 10:41:54 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:53562: 535 Incorrect authentication data (set_id=info@vidaengenharia.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 10:43:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<x3BJpN5DvuQnaoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 10:42:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<EhWDod5D6sxA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2025-11-18 10:42:23 dovecot_login authenticator failed for ([103.55.89.5]) [103.55.89.5]:38354: 535 Incorrect authentication data (set_id=info@deproi.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ek3Cot5DjOexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
country_id: 1814991
description:
2025-11-18 10:42:34 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.73.174]:38846: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.126
country_id: 1819730
description:
2025-11-18 10:42:37 dovecot_login authenticator failed for (223-197-145-126.static.imsbiz.com) [223.197.145.126]:52135: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2025-11-18 10:42:52 dovecot_login authenticator failed for ([161.153.13.153]) [161.153.13.153]:49177: 535 Incorrect authentication data (set_id=atualizacoes1@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2025-11-18 10:42:23 dovecot_login authenticator failed for ([111.61.176.245]) [111.61.176.245]:50990: 535 Incorrect authentication data (set_id=info@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.151.45.136
country_id: 1814991
description:
2025-11-18 10:42:51 dovecot_login authenticator failed for ([182.151.45.136]) [182.151.45.136]:41965: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-11-18 10:43:07 dovecot_login authenticator failed for ([128.185.135.33]) [122.185.145.54]:45994: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 10:43:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<HJWJpd5DauoI2Cjk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.203.9.130
country_id: 2077456
description:
2025-11-18 10:43:54 dovecot_login authenticator failed for 14-203-9-130.tpgi.com.au [14.203.9.130]:59434: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
country_id: 1814991
description:
2025-11-18 10:44:00 dovecot_login authenticator failed for ([123.129.245.249]) [123.129.245.249]:37339: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.192.75.11
country_id: 1814991
description:
2025-11-18 10:43:40 dovecot_login authenticator failed for ([220.192.75.11]) [220.192.75.11]:38740: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2025-11-18 10:43:49 dovecot_login authenticator failed for ([41.216.169.12]) [41.216.169.12]:41770: 535 Incorrect authentication data (set_id=info@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.159.230
country_id: 1835841
description:
2025-11-18 10:43:10 dovecot_login authenticator failed for ([220.72.159.230]) [220.72.159.230]:56392: 535 Incorrect authentication data (set_id=atualizacoes1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 10:43:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<BMUQpd5DyswkMrBu>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 179.130.88.46
country_id: 3469034
description:
[2025-11-18 10:43:18 -0300] info [webmaild] 179.130.88.46 - rh@contabilidadefollador.com.br "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-11-18 10:43:28 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:40830: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7IpTpt5D3JaxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<CByyq95DGMKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-11-18 10:44:14 dovecot_login authenticator failed for ([185.255.47.190]) [185.255.47.190]:45542: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.205.188.194
country_id: 1835841
description:
2025-11-18 10:44:27 dovecot_login authenticator failed for ([119.205.188.194]) [119.205.188.194]:51876: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.11.135
country_id: 1814991
description:
2025-11-18 10:44:31 dovecot_login authenticator failed for ([61.150.11.135]) [61.150.11.135]:34789: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
country_id: 99237
description:
2025-11-18 10:44:48 dovecot_plain authenticator failed for (bacter) [65.20.143.159]:45603: 535 Incorrect authentication data (set_id=neemias.piler@arkson.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.8.42.112
country_id: 1814991
description:
2025-11-18 10:44:49 dovecot_login authenticator failed for (8.171.broad.ha.dynamic.163data.com.cn) [171.8.42.112]:35174: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-11-18 10:44:27 dovecot_login authenticator failed for ([103.147.248.44]) [103.147.248.44]:56888: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.218.128
country_id: 2017370
description:
2025-11-18 10:44:38 dovecot_login authenticator failed for (pool-176-226-218-128.is74.ru) [176.226.218.128]:49084: 535 Incorrect authentication data (set_id=desenvolvimento2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.88.184
country_id: 1668284
description:
2025-11-18 10:44:58 dovecot_login authenticator failed for 110-25-88-184.adsl.fetnet.net [110.25.88.184]:60021: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2025-11-18 10:44:14 dovecot_login authenticator failed for ([103.230.176.152]) [103.230.176.152]:46154: 535 Incorrect authentication data (set_id=faturamento)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mdDgqd5DnLaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.177.171
country_id: 1562822
description:
Nov 18 10:44:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=36.50.177.171, lip=200.150.196.245, session=<53jzqd5DiBIkMrGr>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 10:44:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<8uN2qt5DSJOkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-18 10:44:53 dovecot_plain authenticator failed for (toching) [12.150.243.22]:6482: 535 Incorrect authentication data (set_id=neemias.piler@arkson.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.50.162.66
country_id: 2017370
description:
2025-11-18 10:45:11 dovecot_login authenticator failed for ([94.50.162.66]) [94.50.162.66]:35705: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-11-18 10:45:12 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:50712: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EsCArd5DUNSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.6.11.184
country_id: 1814991
description:
2025-11-18 10:45:41 dovecot_login authenticator failed for ([112.6.11.184]) [112.6.11.184]:57238: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 10:45:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<IrbZrd5DTONSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
country_id: 2017370
description:
2025-11-18 10:45:46 dovecot_login authenticator failed for (92x255x190x69.static-business.omsk.ertelecom.ru) [92.255.190.69]:50560: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.172.244.235
country_id: 6252001
description:
2025-11-18 10:45:08 dovecot_login authenticator failed for c-67-172-244-235.hsd1.ut.comcast.net [67.172.244.235]:35189: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-11-18 10:45:10 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:36388: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 18 10:45:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<bGM4rN5DspYnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.240.44
country_id: 2017370
description:
2025-11-18 10:45:24 dovecot_login authenticator failed for ([46.8.240.44]) [46.8.240.44]:42790: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 10:46:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<E96YsN5DjN4O4dKR>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<x9sMsd5DBu6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 10:46:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<YxS5sd5D7NNw2eny>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 10:46:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<RNzMsd5DvN9SczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2025-11-18 10:46:57 dovecot_login authenticator failed for ([196.189.59.227]) [196.189.59.226]:42071: 535 Incorrect authentication data (set_id=supports@opsconsorcios.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 10:46:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<PwKsr95DBLoXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
country_id: 1835841
description:
2025-11-18 10:46:19 dovecot_login authenticator failed for ([112.186.241.102]) [112.186.241.102]:42129: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-11-18 10:46:34 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:36734: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.75
country_id: 1668284
description:
2025-11-18 10:47:20 dovecot_login authenticator failed for ([101.13.1.75]) [101.13.1.75]:43594: 535 Incorrect authentication data (set_id=supports)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hv2atN5DCKGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.237.47.241
country_id: 1835841
description:
2025-11-18 10:47:39 dovecot_login authenticator failed for ([175.237.47.241]) [175.237.47.241]:58576: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<odVltt5DrK6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 10:47:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@oabsjp.org.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<G/pZs95DZIakXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.165
country_id: 3686110
description:
2025-11-18 10:47:19 dovecot_login authenticator failed for (Dinamic-Tigo186-97-203-165.tigo.com.co) [186.97.203.165]:54463: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.34.237.45
country_id: 285570
description:
2025-11-18 10:48:12 dovecot_login authenticator failed for ([37.34.237.45]) [37.34.237.45]:38456: 535 Incorrect authentication data (set_id=novalondria@cieadep.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.224.227.120
country_id: 1835841
description:
2025-11-18 10:48:28 dovecot_login authenticator failed for ([211.224.227.120]) [211.224.227.120]:43246: 535 Incorrect authentication data (set_id=novalondria)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 143.244.133.47
country_id: 1269750
description:
Nov 18 10:48:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com>, method=PLAIN, rip=143.244.133.47, lip=200.150.196.245, session=<xSTet95D+pmP9IUv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<nn01uN5DUMSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.143
country_id: 2186224
description:
2025-11-18 10:49:30 dovecot_login authenticator failed for ([121.73.163.143]) [121.73.163.143]:46450: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.161.143
country_id: 2186224
description:
2025-11-18 10:49:32 dovecot_login authenticator failed for ([121.73.161.143]) [121.73.161.143]:51796: 535 Incorrect authentication data (set_id=marcelo.pinheiro@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<T4vIu95D8t+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.97.119
country_id: 3996063
description:
2025-11-18 10:49:41 dovecot_login authenticator failed for (201.173.97.119-clientes-izzi.mx) [201.173.97.119]:57964: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 18 10:49:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<OlmHvN5DVuul0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.67.36
country_id: 1814991
description:
2025-11-18 10:49:51 dovecot_login authenticator failed for ([111.26.67.35]) [111.26.67.36]:49782: 535 Incorrect authentication data (set_id=marcelo.pinheiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 10:49:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<c6uNut5DsJsI1et7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.195.126.170
country_id: 2017370
description:
2025-11-18 10:50:28 dovecot_login authenticator failed for ([176.195.126.170]) [176.195.126.170]:54340: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.198.191
country_id: 2186224
description:
2025-11-18 10:50:38 dovecot_login authenticator failed for 219-89-198-191.adsl.xtra.co.nz [219.89.198.191]:33678: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.78.112.81
country_id: 1814991
description:
2025-11-18 10:50:48 dovecot_login authenticator failed for ([218.78.112.81]) [218.78.112.81]:44354: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.194
country_id: 1269750
description:
2025-11-18 10:51:06 dovecot_login authenticator failed for ([182.95.115.194]) [182.95.115.194]:40006: 535 Incorrect authentication data (set_id=sandromiguel@cieadep.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.34.226
country_id: 2017370
description:
2025-11-18 10:50:18 dovecot_login authenticator failed for ([46.149.34.226]) [46.149.34.226]:60154: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-11-18 10:50:45 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:48652: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.112
country_id: 1814991
description:
2025-11-18 10:50:53 dovecot_login authenticator failed for ([27.24.141.112]) [27.24.141.112]:35100: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<H4skwd5D2KSxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bj9Yv95DyIyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2025-11-18 10:51:20 dovecot_login authenticator failed for ([125.19.163.58]) [125.19.163.58]:57408: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.59.34.5
country_id: 1814991
description:
2025-11-18 10:51:55 dovecot_login authenticator failed for ([113.59.34.8]) [113.59.34.5]:50276: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 122.144.131.25
country_id: 1814991
description:
Nov 18 10:51:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=122.144.131.25, lip=200.150.196.245, session=<D5rLwd5DWKl6kIMZ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.122
country_id: 1668284
description:
2025-11-18 10:51:13 dovecot_login authenticator failed for 111-70-3-122.emome-ip.hinet.net [111.70.3.122]:40197: 535 Incorrect authentication data (set_id=presidencia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.196.118
country_id: 1814991
description:
2025-11-18 10:51:26 dovecot_login authenticator failed for ([123.129.196.118]) [123.129.196.118]:53623: 535 Incorrect authentication data (set_id=sandromiguel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.15.149.254
country_id: 3469034
description:
2025-11-18 10:51:39 dovecot_login authenticator failed for ([187.7.85.97]) [201.15.149.254]:56319: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 10:51:13 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:57525: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2025-11-18 10:51:55 dovecot_login authenticator failed for ([185.112.148.66]) [185.112.148.66]:60887: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FTTtwt5DKLKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.104.103.146
country_id: 1814991
description:
2025-11-18 10:51:31 dovecot_login authenticator failed for ([180.104.103.146]) [180.104.103.146]:57312: 535 Incorrect authentication data (set_id=secretarioadjunto)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.235.16.64
country_id: 3469034
description:
[2025-11-18 10:52:00 -0300] info [webmaild] 45.235.16.64 - lucas@cavilhasdiesel.com.br "GET /cpsess1494109354/3rdparty/roundcube/?_task=mail HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 10:52:05 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:57955: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.119.132.230
country_id: 2510769
description:
2025-11-18 10:51:25 dovecot_login authenticator failed for ([176.119.132.230]) [176.119.132.230]:60112: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.141
country_id: 3469034
description:
2025-11-18 10:52:28 dovecot_login authenticator failed for (ADMIN) [181.191.136.141]:52328: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.249.175.243
country_id: 298795
description:
2025-11-18 10:52:40 dovecot_login authenticator failed for ([185.250.240.220]) [88.249.175.243]:46424: 535 Incorrect authentication data (set_id=faturamento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2025-11-18 10:52:41 dovecot_login authenticator failed for ([119.192.59.80]) [119.192.59.80]:42594: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.167.203.56
country_id: 1814991
description:
2025-11-18 10:52:59 dovecot_login authenticator failed for ([223.167.203.56]) [223.167.203.56]:50692: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-11-18 10:52:17 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (mozatingra) [80.14.31.158]:38292: 535 Incorrect authentication data (set_id=e2f63808kof@89fmjoinville.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 10:52:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<Ttu5xd5D1oul0xnK>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<nOp8xt5DqtGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 10:52:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<5Vmcxt5D/ODBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.243.106.218
country_id: 2802361
description:
2025-11-18 10:52:54 dovecot_login authenticator failed for 218.106-243-81.adsl-dyn.isp.belgacom.be [81.243.106.218]:52154: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.96.2
country_id: 1814991
description:
2025-11-18 10:52:58 dovecot_login authenticator failed for ([219.129.96.2]) [219.129.96.2]:37181: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.138.200.44
country_id: 1814991
description:
2025-11-18 10:52:14 dovecot_login authenticator failed for ([219.138.200.44]) [219.138.200.44]:36214: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+Xzjy95DnIyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 10:54:03 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:62438: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.250
country_id: 2186224
description:
2025-11-18 10:53:22 dovecot_login authenticator failed for ([121.73.163.250]) [121.73.163.250]:37902: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</YwVyt5DguexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 10:53:51 dovecot_login authenticator failed for (User) [177.74.174.120]:52935: 535 Incorrect authentication data (set_id=juliana@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 10:54:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<hp1azd5Ds9Z3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.96.232
country_id: 294640
description:
2025-11-18 10:54:37 dovecot_login authenticator failed for ([46.210.96.232]) [46.210.96.232]:49345: 535 Incorrect authentication data (set_id=novamanha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.38
country_id: 1668284
description:
2025-11-18 10:55:05 dovecot_login authenticator failed for 221-120-4-38.emome-ip.hinet.net [221.120.4.38]:42504: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.215.39
country_id: 3469034
description:
2025-11-18 10:54:13 dovecot_login authenticator failed for ([189.108.215.39]) [189.108.215.39]:58877: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 10:54:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<xBRbzN5Dgo8v7PP+>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<O0yozd5DbJaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 10:54:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<69ukzt5DbKXSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
country_id: 2328926
description:
2025-11-18 10:55:03 dovecot_login authenticator failed for ([102.88.10.10]) [102.88.10.10]:35264: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 10:54:07 dovecot_login authenticator failed for (User) [177.74.174.120]:52935: 535 Incorrect authentication data (set_id=juliana@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.179.206.6
country_id: 6252001
description:
2025-11-18 10:55:26 dovecot_login authenticator failed for (syn-072-179-206-006.res.spectrum.com) [72.179.206.6]:58481: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bms80d5D+LOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.61.21
country_id: 1814991
description:
2025-11-18 10:55:33 dovecot_login authenticator failed for ([112.102.61.21]) [112.102.61.21]:49179: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2025-11-18 10:55:45 dovecot_login authenticator failed for (bb118-200-42-112.singnet.com.sg) [118.200.42.112]:38906: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6j+c1t5D9NexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2025-11-18 10:56:13 dovecot_login authenticator failed for ([1.237.155.150]) [1.237.155.150]:58906: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 10:56:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<pc+I095DGMhA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.79.21
country_id: 1814991
description:
2025-11-18 10:56:26 dovecot_login authenticator failed for (251.78.212.118.adsl-pool.jx.chinaunicom.com) [118.212.79.21]:38910: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:56:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Tgbb1N5DqMqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.6.31
country_id: 1880251
description:
2025-11-18 10:57:54 dovecot_login authenticator failed for (31.6.245.49.unknown.m1.com.sg) [49.245.6.31]:47001: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.112.238
country_id: 2328926
description:
2025-11-18 10:57:19 dovecot_login authenticator failed for ([196.200.112.238]) [196.200.112.238]:1572: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:57:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Z8xs2N5DbuSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.210.118
country_id: 1269750
description:
2025-11-18 10:57:38 dovecot_login authenticator failed for ([152.52.210.118]) [152.52.210.118]:51886: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
country_id: 1512440
description:
2025-11-18 10:57:48 dovecot_login authenticator failed for ([213.230.65.53]) [213.230.65.53]:50902: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 10:57:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<y51/2d5DOI4tPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.112
country_id: 1814991
description:
2025-11-18 10:58:53 dovecot_login authenticator failed for ([27.24.141.112]) [27.24.141.112]:55654: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
country_id: 1835841
description:
2025-11-18 10:58:58 dovecot_login authenticator failed for ([111.171.125.94]) [111.171.125.94]:41852: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 10:59:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<aGq+3d5D5qBSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.223.133.104
country_id: 3469034
description:
2025-11-18 10:58:25 dovecot_login authenticator failed for (104.133.223.177.static.yepnet.com.br) [177.223.133.104]:38154: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.82.102.36
country_id: 3686110
description:
2025-11-18 10:58:29 dovecot_plain authenticator failed for (hmqu9flnlwg9h17bcp4d876uqfwu21) [186.82.102.36]:1831: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JtT8295DuJGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-11-18 10:58:45 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:56417: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 10:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<jaCI395DssGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-11-18 10:59:48 dovecot_login authenticator failed for (186.235.248.73.girardi-rs.com.br) [186.235.248.73]:54000: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-18 10:59:24 dovecot_login authenticator failed for ([196.191.212.226]) [213.55.85.202]:3685: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2025-11-18 10:59:13 dovecot_login authenticator failed for (nsg-static-82.71.76.182-airtel.com) [182.76.71.82]:39498: 535 Incorrect authentication data (set_id=compras@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 10:59:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<8nN43t5D1IXSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.95
country_id: 6252001
description:
2025-11-18 10:59:29 dovecot_login authenticator failed for ([70.174.168.95]) [70.174.168.95]:60775: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 10:59:31 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [seventreinamentos]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2025-11-18 10:59:32 dovecot_login authenticator failed for ([103.220.16.51]) [103.220.16.51]:50740: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.20.228.20
country_id: 1269750
description:
2025-11-18 10:59:09 dovecot_login authenticator failed for ([157.20.228.20]) [157.20.228.20]:57370: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.193.128.123
country_id: 1269750
description:
2025-11-18 10:59:38 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [116.193.128.123]:50884: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rdNP4d5DSsuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-18 10:59:10 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:12950: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 11:01:02 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:61283: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.99.95
country_id: 3469034
description:
2025-11-18 11:00:35 dovecot_login authenticator failed for (ecosistemas.static.gvt.net.br) [177.159.99.95]:51752: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 11:00:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<RomS5N5DGJTBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2025-11-18 11:00:19 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:55862: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1GAk495DeN2xV3kv>


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:00:47 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [seventreinamentos]


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:00:16 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [seventreinamentos]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.166.54
country_id: 1269750
description:
2025-11-18 11:01:15 dovecot_login authenticator failed for ([125.19.95.209]) [122.187.166.54]:45710: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
country_id: 1814991
description:
2025-11-18 11:01:47 dovecot_login authenticator failed for ([223.241.214.127]) [223.241.214.127]:57979: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 129.226.64.141
country_id: 1819730
description:
Nov 18 11:01:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pirajusolucoes.com.br>, method=PLAIN, rip=129.226.64.141, lip=200.150.196.245, session=<O0885d5DArKB4kCN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.122.211.212
country_id: 1814991
description:
2025-11-18 11:01:10 dovecot_login authenticator failed for (opsconsorcios.com.br) [111.122.211.212]:51652: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 11:01:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@primiciapersianas.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<cfTk5d5DuKd2wSaf>


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:01:32 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [seventreinamentos]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JMe35t5DEoWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.199.10.82
country_id: 3175395
description:
2025-11-18 11:02:06 dovecot_login authenticator failed for host-31-199-10-82.business.telecomitalia.it [31.199.10.82]:56162: 535 Incorrect authentication data (set_id=desenvolvimento2)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 50.207.23.120
country_id: 6252001
description:
Nov 18 11:01:16 hosting pure-ftpd: (?@50.207.23.120) [WARNING] Authentication failed for user [seventreinamentos]


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 11:01:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<BtjT5d5DSJg+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.14.58
country_id: 1814991
description:
2025-11-18 11:02:13 dovecot_login authenticator failed for ([210.12.14.58]) [210.12.14.58]:59684: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 11:02:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<yTGz6t5D1NlSnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 11:02:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<sjBI695D1tAkMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.11.231.177
country_id: 1814991
description:
2025-11-18 11:02:57 dovecot_login authenticator failed for ([1.15.123.146]) [175.11.231.177]:57606: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JcIV7N5Deq2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 18 11:02:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<O5Uq6t5DNq157bKF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2025-11-18 11:02:35 dovecot_login authenticator failed for ([50.231.243.28]) [50.231.243.28]:50106: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-11-18 11:02:50 dovecot_login authenticator failed for works.ssc-gr.info [160.251.121.70]:45824: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
country_id: 1814991
description:
2025-11-18 11:02:53 dovecot_login authenticator failed for ([222.186.68.153]) [222.186.68.153]:33715: 535 Incorrect authentication data (set_id=bruno)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.142
country_id: 3469034
description:
2025-11-18 11:02:15 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18670: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-11-18 11:02:36 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:48834: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2025-11-18 11:02:20 dovecot_login authenticator failed for ([111.26.63.87]) [111.26.63.87]:57520: 535 Incorrect authentication data (set_id=desenvolvimento2)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<r6ZH6t5DVJ+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
country_id: 1814991
description:
2025-11-18 11:03:20 dovecot_login authenticator failed for ([220.180.166.214]) [220.180.166.214]:48943: 535 Incorrect authentication data (set_id=hcpontagrossa@hipercesta.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 11:03:31 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:62275: 535 Incorrect authentication data (set_id=admin@jacgeneralcleaning.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.115.144.103
country_id: 3469034
description:
2025-11-18 11:03:55 dovecot_login authenticator failed for (191.34.253.17.dynamic.adsl.gvt.net.br) [187.115.144.103]:48006: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.46.237.133
country_id: 2921044
description:
2025-11-18 11:03:37 dovecot_login authenticator failed for li2180-133.members.linode.com [192.46.237.133]:35858: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.49.18
country_id: 1269750
description:
2025-11-18 11:03:40 dovecot_login authenticator failed for ([45.118.49.18]) [45.118.49.18]:57665: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.212.178
country_id: 1269750
description:
2025-11-18 11:03:46 dovecot_login authenticator failed for ([152.52.144.161]) [128.185.212.178]:52642: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 11:03:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<Vqyr7t5DsNxCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-11-18 11:03:24 dovecot_login authenticator failed for (182.239.78.124.hk.chinamobile.com) [182.239.78.124]:53690: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.59.34.5
country_id: 1814991
description:
2025-11-18 11:03:30 dovecot_login authenticator failed for ([113.59.34.8]) [113.59.34.5]:50123: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IV/T7d5DELqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.19.166
country_id: 290557
description:
2025-11-18 11:03:32 dovecot_login authenticator failed for ([94.207.19.166]) [94.207.19.166]:35185: 535 Incorrect authentication data (set_id=hcpontagrossa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-11-18 11:03:52 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:59306: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.98.235.34
country_id: 1814991
description:
2025-11-18 11:04:31 dovecot_login authenticator failed for ([114.98.235.34]) [114.98.235.34]:58586: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<U9Jo8d5D4texV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-11-18 11:04:52 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:52944: 535 Incorrect authentication data (set_id=lucas@vivoconsorcios.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 11:04:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<5k3X8t5D9JR3xBIC>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ptL99N5DIoOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.164.98.205
country_id: 3469034
description:
2025-11-18 11:05:36 dovecot_login authenticator failed for ([45.164.98.205]) [45.164.98.205]:51048: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.172
country_id: 1668284
description:
2025-11-18 11:05:47 dovecot_login authenticator failed for (58-115-53-172.twt1.com.tw) [58.115.53.172]:50442: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 11:05:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<mC6V9N5DFNXBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.69.133.140
country_id: 1562822
description:
2025-11-18 11:05:22 dovecot_login authenticator failed for ([118.69.133.140]) [118.69.133.140]:57970: 535 Incorrect authentication data (set_id=lucas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.166
country_id: 1269750
description:
2025-11-18 11:05:23 dovecot_login authenticator failed for ([182.95.131.41]) [103.251.31.166]:42434: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-11-18 11:05:26 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:49199: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.24.40
country_id: 2017370
description:
2025-11-18 11:05:46 dovecot_login authenticator failed for (46-44-24-40.silinet.ru) [46.44.24.40]:57737: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 11:05:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<zePb9d5DPt4tPZWl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NcvJ9t5DDpmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.92.136.185
country_id: 1814991
description:
2025-11-18 11:06:03 dovecot_login authenticator failed for ([183.92.156.184]) [183.92.136.185]:42115: 535 Incorrect authentication data (set_id=coordenacao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.0.90
country_id: 2017370
description:
2025-11-18 11:05:12 dovecot_login authenticator failed for ([213.234.0.90]) [213.234.0.90]:50498: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.60.146
country_id: 1814991
description:
2025-11-18 11:06:33 dovecot_login authenticator failed for ([180.168.60.146]) [180.168.60.146]:55757: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<r9uY+N5DNqWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 11:06:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<l+4H+t5DrrVAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.110
country_id: 1269750
description:
2025-11-18 11:07:08 dovecot_login authenticator failed for (dsl-ncr-dynamic-201.85.23.125.airtelbroadband.in) [182.95.57.110]:38118: 535 Incorrect authentication data (set_id=salamuni)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 11:06:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<7WkF995DgvVxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.122
country_id: 1269750
description:
2025-11-18 11:06:11 dovecot_login authenticator failed for ([125.16.31.25]) [152.52.236.122]:53874: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 11:06:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<khzp+d5DPsIv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2025-11-18 11:06:13 dovecot_plain authenticator failed for c-76-157-219-158.hsd1.il.comcast.net (wismacha) [76.157.219.158]:34450: 535 Incorrect authentication data (set_id=marcoaurelio.vendas@maringatruckparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-11-18 11:06:16 dovecot_login authenticator failed for ([36.50.167.81]) [36.50.167.81]:34290: 535 Incorrect authentication data (set_id=coordenacao)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 189.49.233.224
country_id: 3469034
description:
[2025-11-18 11:07:03 -0300] info [webmaild] 189.49.233.224 - operacoes@huboperacoes.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 11:06:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<gZr6+N5DspM+PIOL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 11:06:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<nFMT995DKqNA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-11-18 11:06:09 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (liked) [87.103.126.54]:32783: 535 Incorrect authentication data (set_id=marcoaurelio.vendas@maringatruckparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.119
country_id: 1814991
description:
2025-11-18 11:07:27 dovecot_login authenticator failed for ([111.26.106.118]) [111.26.106.119]:46832: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.165.1.71
country_id: 1814991
description:
2025-11-18 11:07:29 dovecot_login authenticator failed for ([180.165.1.71]) [180.165.1.71]:53438: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-18 11:07:32 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:57056: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6sYs/N5DGsWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2025-11-18 11:07:47 dovecot_login authenticator failed for ([123.209.106.190]) [123.209.106.190]:42362: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.43.236
country_id: 1814991
description:
2025-11-18 11:07:49 dovecot_login authenticator failed for ([183.6.43.236]) [183.6.43.236]:44404: 535 Incorrect authentication data (set_id=salamuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.176.229.36
country_id: 2017370
description:
2025-11-18 11:07:58 dovecot_login authenticator failed for ([178.176.229.36]) [178.176.229.36]:40280: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
country_id: 1814991
description:
2025-11-18 11:08:25 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:35899: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-11-18 11:08:37 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:37258: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.142
country_id: 3469034
description:
2025-11-18 11:08:44 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18549: 535 Incorrect authentication data (set_id=flaviabastos@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 11:08:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<flxqAN9DOoV9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.162.117
country_id: 2017370
description:
2025-11-18 11:08:11 dovecot_login authenticator failed for broadband-77-37-162-117.ip.moscow.rt.ru [77.37.162.117]:38904: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 11:08:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<Ite+AN9DdDRo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.6.226.122
country_id: 1562822
description:
2025-11-18 11:08:25 dovecot_login authenticator failed for ([117.6.226.122]) [117.6.226.122]:46701: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 11:08:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<d1lb/95DpCyvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.81.45.147
country_id: 6252001
description:
2025-11-18 11:08:29 dovecot_login authenticator failed for ([172.81.45.147]) [172.81.45.147]:40360: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 11:08:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<jFCK/95DnpE7GIXF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 11:08:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<Zy90AN9DlLdxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-18 11:08:47 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:57937: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8A21/95DNOOxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vuOEAd9DYoixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.223
country_id: 1668284
description:
2025-11-18 11:09:06 dovecot_login authenticator failed for 111-70-23-223.emome-ip.hinet.net [111.70.23.223]:54471: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.131.216.81
country_id: 660013
description:
2025-11-18 11:09:47 dovecot_login authenticator failed for dynamic-216-81.keskikaista.fi [185.131.216.81]:47984: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.15.224.102
country_id: 1814991
description:
2025-11-18 11:09:12 dovecot_login authenticator failed for ([218.15.224.102]) [218.15.224.102]:42996: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.80.74
country_id: 1819730
description:
2025-11-18 11:09:38 dovecot_login authenticator failed for ([182.239.80.74]) [182.239.80.74]:48237: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.213.16
country_id: 732800
description:
2025-11-18 11:09:17 dovecot_login authenticator failed for 95-87-213-16.ip.btc-net.bg [95.87.213.16]:55933: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xFpUA99D9J6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.238.237.254
country_id: 1835841
description:
2025-11-18 11:09:40 dovecot_login authenticator failed for ([211.238.237.254]) [211.238.237.254]:51505: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2025-11-18 11:09:09 dovecot_plain authenticator failed for (bam1p4pwo0leyzlyczxu9hjje3vech) [1.212.225.99]:48358: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-11-18 11:09:16 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:53168: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.133.161.162
country_id: 130758
description:
2025-11-18 11:10:43 dovecot_login authenticator failed for ([85.133.161.162]) [85.133.161.162]:52690: 535 Incorrect authentication data (set_id=adm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
country_id: 1814991
description:
2025-11-18 11:11:06 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:38421: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.33.253
country_id: 6290252
description:
2025-11-18 11:10:18 dovecot_login authenticator failed for (dyn-33-253.kbcnet.rs) [109.207.33.253]:46718: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2025-11-18 11:10:24 dovecot_login authenticator failed for ([200.148.171.233]) [189.56.0.19]:37041: 535 Incorrect authentication data (set_id=adm@sulindustrial.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Z6XlBt9DcL2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 11:10:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@alcantaraemonteiro.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<y07lBt9DMOB2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-18 11:10:55 dovecot_plain authenticator failed for (pirelowfus) [24.187.213.29]:34850: 535 Incorrect authentication data (set_id=novidadevida@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 11:10:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pousadarincaoalegre.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<j1JKBd9DkIpzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-11-18 11:10:08 dovecot_login authenticator failed for ([152.52.244.46]) [152.52.244.46]:42194: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
country_id: 2661886
description:
2025-11-18 11:11:29 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (vicale) [81.225.30.107]:39648: 535 Incorrect authentication data (set_id=e2f63808kof@89fmjoinville.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-18 11:11:32 dovecot_login authenticator failed for (calcautomation.com) [112.122.54.54]:11079: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2025-11-18 11:11:32 dovecot_plain authenticator failed for (pabusly) [12.150.243.22]:56378: 535 Incorrect authentication data (set_id=e2f63808kof@89fmjoinville.com)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4iJ5Ct9DwOKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
country_id: 2077456
description:
2025-11-18 11:11:47 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:39326: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-11-18 11:11:56 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:43466: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 11:11:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<yfoWCd9DftZrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.15
country_id: 1668284
description:
2025-11-18 11:11:45 dovecot_login authenticator failed for 111-70-11-15.emome-ip.hinet.net [111.70.11.15]:32938: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 11:11:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<8Q6PC99D9tgXXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:12:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<m9lGDN9DqIKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.234
country_id: 2186224
description:
2025-11-18 11:11:37 dovecot_login authenticator failed for ([121.73.168.234]) [121.73.168.234]:55896: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 11:13:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<YQoFEt9D6MhCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 11:13:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<eSzyEt9D3Mx9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-11-18 11:13:23 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:60386: 535 Incorrect authentication data (set_id=info@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.145.54
country_id: 1269750
description:
2025-11-18 11:13:30 dovecot_login authenticator failed for ([122.185.145.54]) [122.185.145.54]:40500: 535 Incorrect authentication data (set_id=atualizacoes1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.133.117
country_id: 1835841
description:
2025-11-18 11:13:37 dovecot_login authenticator failed for ([218.146.133.117]) [218.146.133.117]:59735: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.82.9.238
country_id: 6252001
description:
2025-11-18 11:13:48 dovecot_login authenticator failed for (1075fm.com.br) [206.82.9.238]:49603: 535 Incorrect authentication data (set_id=opec@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
country_id: 1819730
description:
2025-11-18 11:14:11 dovecot_login authenticator failed for (223-197-153-143.static.imsbiz.com) [223.197.153.143]:50538: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2025-11-18 11:13:25 dovecot_login authenticator failed for 143.38.109.208.host.secureserver.net [208.109.38.143]:37856: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<oN+iEd9DBKuxV3kv>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 177.16.29.122
country_id: 3469034
description:
[2025-11-18 11:14:21 -0300] info [webmaild] 177.16.29.122 - compras@arkson.com.br "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.222.149.239
country_id: 6251999
description:
2025-11-18 11:14:21 dovecot_login authenticator failed for host-24-222-149-239.public.eastlink.ca [24.222.149.239]:36722: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:14:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lu43Fd9DwsuxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EmH+Ft9D4taxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-18 11:15:12 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:62996: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 11:15:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<iZk7GN9DpoEtPZWl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rCvAGN9DIOuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 18 11:15:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<AHi5GN9DcOadQi/y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.145.27
country_id: 290557
description:
2025-11-18 11:15:23 dovecot_login authenticator failed for ([91.74.145.27]) [91.74.145.27]:39652: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 11:17:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@fernandotonet.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<QI8TH99DLM92wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 11:16:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<42fSG99D6p8tPZWl>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XKJUHN9DMp2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 11:16:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<wzBPHN9DroZAF/Qn>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.137.123.36
country_id: 1814991
description:
Nov 18 11:17:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@missgospel.com>, method=PLAIN, rip=8.137.123.36, lip=200.150.196.245, session=<0FExHt9DWtcIiXsk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.209.157.209
country_id: 2921044
description:
2025-11-18 11:17:13 dovecot_login authenticator failed for (localhost) [213.209.157.209]:52285: 535 Incorrect authentication data (set_id=opec@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 11:17:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<w03FHt9DkJF3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 11:18:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<d3pqId9D1o+kXF7M>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vjCxId9DpMWxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:17:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QOvyH99DGLuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.16.16
country_id: 1814991
description:
2025-11-18 11:18:35 dovecot_login authenticator failed for ([219.144.16.16]) [219.144.16.16]:59711: 535 Incorrect authentication data (set_id=contato@acmesolar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
country_id: 732800
description:
2025-11-18 11:18:46 dovecot_login authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:51727: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2025-11-18 11:18:53 dovecot_login authenticator failed for (95.158.39.201.bestsolution.net.ua) [95.158.39.201]:41318: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.13.23
country_id: 1668284
description:
2025-11-18 11:19:05 dovecot_login authenticator failed for 111-70-13-23.emome-ip.hinet.net [111.70.13.23]:35259: 535 Incorrect authentication data (set_id=igreja@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.142
country_id: 3469034
description:
2025-11-18 11:18:20 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18747: 535 Incorrect authentication data (set_id=fabio@fkrepresentacoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8pGCI99DiNqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-11-18 11:18:38 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:61467: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 11:19:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<j3RgJd9DWMlrhr+5>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.83
country_id: 1814991
description:
2025-11-18 11:19:48 dovecot_login authenticator failed for ([36.135.62.82]) [36.135.62.83]:42770: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 11:19:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<gp2RKN9DZId3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.131
country_id: 1835841
description:
2025-11-18 11:20:04 dovecot_login authenticator failed for ([1.235.192.131]) [1.235.192.131]:48937: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.124
country_id: 1668284
description:
2025-11-18 11:20:09 dovecot_login authenticator failed for 111-70-38-124.emome-ip.hinet.net [111.70.38.124]:40310: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 11:20:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<iS0vKd9Dzo9CYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 18 11:19:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<R3rjJt9DLO0vT1jH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MbIRJ99DBoyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.196.230
country_id: 1814991
description:
2025-11-18 11:19:31 dovecot_login authenticator failed for ([118.122.196.230]) [118.122.196.230]:48785: 535 Incorrect authentication data (set_id=igreja)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-18 11:19:54 dovecot_plain authenticator failed for (inolved) [192.34.128.202]:52264: 535 Incorrect authentication data (set_id=amarildo@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.128.7
country_id: 1814991
description:
2025-11-18 11:20:58 dovecot_login authenticator failed for ([58.17.128.7]) [58.17.128.7]:56358: 535 Incorrect authentication data (set_id=salamuni)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Kx6gKt9D2KixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-11-18 11:20:39 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:50904: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.192.114.251
country_id: 6252001
description:
2025-11-18 11:20:50 dovecot_plain authenticator failed for c-98-192-114-251.hsd1.ga.comcast.net (ratemis) [98.192.114.251]:34543: 535 Incorrect authentication data (set_id=marcelo@htmferramentas.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 11:20:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<lLjNK99DFuhw2eny>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2025-11-18 11:20:55 dovecot_login authenticator failed for ([218.22.187.68]) [218.22.187.66]:40445: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<r9ZwLN9DkrqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.79.112
country_id: 1814991
description:
2025-11-18 11:21:11 dovecot_login authenticator failed for ([111.26.79.111]) [111.26.79.112]:55830: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2025-11-18 11:20:24 dovecot_login authenticator failed for (IP-122-133.bol-online.com) [182.163.122.133]:12439: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.16.91
country_id: 1880251
description:
2025-11-18 11:20:41 dovecot_login authenticator failed for (91.16.156.202.starhub.net.sg) [202.156.16.91]:33602: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-18 11:20:44 dovecot_login authenticator failed for (letracaixa.art.br) [112.122.54.54]:32068: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.103
country_id: 1814991
description:
2025-11-18 11:21:16 dovecot_login authenticator failed for ([36.135.62.102]) [36.135.62.103]:47560: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-11-18 11:22:12 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:48038: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2025-11-18 11:21:24 dovecot_login authenticator failed for (113-11-34-221-smile.com.bd) [113.11.34.221]:55310: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 11:21:23 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:58101: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ujczLt9DusWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.143.69.79
country_id: 2750405
description:
2025-11-18 11:21:37 dovecot_login authenticator failed for ([108.143.69.79]) [108.143.69.79]:48988: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.140.111
country_id: 1819730
description:
2025-11-18 11:21:50 dovecot_login authenticator failed for (m121-202-140-111.smartone.com) [121.202.140.111]:3717: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.111.34
country_id: 1269750
description:
2025-11-18 11:21:50 dovecot_login authenticator failed for ([182.78.111.34]) [182.78.111.34]:36530: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mqDTMd9DzOWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.169.82.194
country_id: 935317
description:
2025-11-18 11:22:48 dovecot_login authenticator failed for (165-169-82-194.zeop.re) [165.169.82.194]:57747: 535 Incorrect authentication data (set_id=feedback@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.89.122
country_id: 1814991
description:
2025-11-18 11:23:17 dovecot_login authenticator failed for ([60.216.89.122]) [60.216.89.122]:46204: 535 Incorrect authentication data (set_id=feedback)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.61.21
country_id: 1814991
description:
2025-11-18 11:23:03 dovecot_login authenticator failed for ([112.102.61.21]) [112.102.61.21]:51524: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.208.233
country_id: 6252001
description:
2025-11-18 11:22:21 dovecot_login authenticator failed for 75.97.208.233.res-cmts.blm.ptd.net [75.97.208.233]:50438: 535 Incorrect authentication data (set_id=partners@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.167.15
country_id: 2186224
description:
2025-11-18 11:22:27 dovecot_login authenticator failed for ([121.73.167.15]) [121.73.167.15]:45692: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.79.237
country_id: 2017370
description:
2025-11-18 11:22:37 dovecot_login authenticator failed for broadband-188-32-79-237.ip.moscow.rt.ru [188.32.79.237]:35194: 535 Incorrect authentication data (set_id=partners)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2025-11-18 11:22:52 dovecot_login authenticator failed for ([65.20.131.63]) [65.20.131.63]:35511: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vhEnN99DcqOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
country_id: 6252001
description:
2025-11-18 11:23:41 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.64.170]:49086: 535 Incorrect authentication data (set_id=vendas3@singseguros.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 11:23:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<pRrbNd9DcK0I2Cjk>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 11:23:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<FGHzNd9DFIWkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.11.230.160
country_id: 2510769
description:
2025-11-18 11:23:50 dovecot_login authenticator failed for 160.red-88-11-230.dynamicip.rima-tde.net [88.11.230.160]:56841: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.158.24.119
country_id: 1814991
description:
2025-11-18 11:24:03 dovecot_login authenticator failed for ([27.158.58.178]) [27.158.24.119]:4055: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 11:23:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<lcIwNd9DwmevfiX3>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<38hlNd9DdpCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-18 11:23:34 dovecot_login authenticator failed for (125-209-116-242.multi.net.pk) [58.27.253.6]:18060: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.203.179.228
country_id: 1814991
description:
2025-11-18 11:23:41 dovecot_login authenticator failed for ([218.203.179.228]) [218.203.179.228]:52404: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RIr4ON9DtrGxV3kv>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.94.168.28
country_id: 3469034
description:
[2025-11-18 11:24:35 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.176.195
country_id: 798544
description:
2025-11-18 11:24:34 dovecot_login authenticator failed for 5.185.176.195.ipv4.public.orange.pl [5.185.176.195]:58066: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.57.136.141
country_id: 2017370
description:
2025-11-18 11:25:07 dovecot_login authenticator failed for ([212.57.136.141]) [212.57.136.141]:44384: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.158.224.90
country_id: 2658434
description:
2025-11-18 11:25:16 dovecot_login authenticator failed for ([194.158.224.90]) [194.158.224.90]:33902: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 11:25:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<1tS3Ot9DTLFzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.59.34.5
country_id: 1814991
description:
2025-11-18 11:25:14 dovecot_login authenticator failed for ([113.59.34.8]) [113.59.34.5]:40683: 535 Incorrect authentication data (set_id=info@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.203.70.75
country_id: 3374766
description:
2025-11-18 11:25:56 dovecot_login authenticator failed for ([154.203.70.75]) [154.203.70.75]:56435: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2025-11-18 11:26:02 dovecot_login authenticator failed for (cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:56753: 535 Incorrect authentication data (set_id=dayanelima@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.37.100.53
country_id: 1814991
description:
2025-11-18 11:25:31 dovecot_login authenticator failed for ([58.37.100.53]) [58.37.100.53]:42786: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.22.122.154
country_id: 3469034
description:
2025-11-18 11:25:48 dovecot_login authenticator failed for (177.22.122.154.rev.corporativafiber.com.br) [177.22.122.154]:52181: 535 Incorrect authentication data (set_id=rogerioamorim)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 203.124.45.140
country_id: 1168579
description:
Nov 18 11:25:49 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<financeiro@dlmoveis.com.br>, method=PLAIN, rip=203.124.45.140, lip=200.150.196.245, TLS, session=<1FI1PN9Ds87LfC2M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2025-11-18 11:25:41 dovecot_login authenticator failed for mail.sotus.co.th [171.100.156.38]:39999: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.108
country_id: 6252001
description:
2025-11-18 11:25:43 dovecot_login authenticator failed for ([70.174.168.108]) [70.174.168.108]:36397: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2025-11-18 11:25:53 dovecot_login authenticator failed for (made-again.tmesis.com) [24.187.213.29]:49022: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.191.219
country_id: 1821275
description:
2025-11-18 11:26:08 dovecot_login authenticator failed for nz191l219.bb18094.ctm.net [180.94.191.219]:48344: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-18 11:25:27 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:36334: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<70CNPN9DItaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.101.77
country_id: 1814991
description:
2025-11-18 11:25:40 dovecot_login authenticator failed for ([111.26.101.76]) [111.26.101.77]:38458: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.192.226.83
country_id: 2017370
description:
2025-11-18 11:25:24 dovecot_login authenticator failed for ([62.192.226.83]) [62.192.226.83]:45156: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-11-18 11:25:37 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:42484: 535 Incorrect authentication data (set_id=rogerioamorim@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.196.185
country_id: 2017370
description:
2025-11-18 11:25:55 dovecot_login authenticator failed for ([5.142.196.185]) [5.142.196.185]:47929: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.140.134
country_id: 1562822
description:
2025-11-18 11:26:30 dovecot_login authenticator failed for ([171.244.140.134]) [171.244.140.134]:22662: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<pTMbQN9D+oSxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<d7biQd9D4pKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.189.80.73
country_id: 2510769
description:
2025-11-18 11:27:15 dovecot_login authenticator failed for 73.pool92-189-80.dynamic.orange.es [92.189.80.73]:46598: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.70
country_id: 1269750
description:
2025-11-18 11:27:10 dovecot_login authenticator failed for ([59.145.114.129]) [182.95.115.70]:35716: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.163.119
country_id: 1880251
description:
[2025-11-18 11:27:14 -0300] info [cpaneld] 152.42.163.119 - bonfitne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bonfitne (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.13.62.77
country_id: 2017370
description:
2025-11-18 11:26:30 dovecot_login authenticator failed for ([81.13.62.77]) [81.13.62.77]:51014: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.195.66
country_id: 1269750
description:
2025-11-18 11:26:33 dovecot_login authenticator failed for ([125.19.195.66]) [125.19.195.66]:44862: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.121.175.167
country_id: 1835841
description:
2025-11-18 11:26:33 dovecot_login authenticator failed for ([58.121.175.167]) [58.121.175.167]:50362: 535 Incorrect authentication data (set_id=dayanelima)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 11:26:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<uqI4QN9D6MdSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.90.176
country_id: 690791
description:
2025-11-18 11:26:46 dovecot_login authenticator failed for (host176-90-16-178.reedlan.com) [178.16.90.176]:39870: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.79.120.248
country_id: 6251999
description:
2025-11-18 11:26:50 dovecot_login authenticator failed for s01060030f43b0098.vn.shawcable.net [70.79.120.248]:49921: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.41.217
country_id: 2077456
description:
2025-11-18 11:26:52 dovecot_login authenticator failed for 110-175-41-217.static.tpgi.com.au [110.175.41.217]:58316: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.103.30
country_id: 1814991
description:
2025-11-18 11:27:10 dovecot_login authenticator failed for ([36.135.103.30]) [36.135.103.30]:33260: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.160.175
country_id: 2661886
description:
2025-11-18 11:27:12 dovecot_login authenticator failed for 37-46-160-175.customers.ownit.se [37.46.160.175]:53848: 535 Incorrect authentication data (set_id=info@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
country_id: 458258
description:
2025-11-18 11:26:22 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:40584: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.142
country_id: 3469034
description:
2025-11-18 11:26:51 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:19164: 535 Incorrect authentication data (set_id=fundicao@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-11-18 11:26:57 dovecot_login authenticator failed for (dsl-mp-dynamic-054.140.23.125.airtelbroadband.in) [125.23.140.54]:38544: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-11-18 11:27:13 dovecot_login authenticator failed for ([65.20.233.110]) [65.20.233.110]:35798: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.87
country_id: 6252001
description:
2025-11-18 11:27:16 dovecot_login authenticator failed for ([70.174.168.87]) [70.174.168.87]:55586: 535 Incorrect authentication data (set_id=media@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 11:27:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<zdtGRN9DbugO4dKR>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2025-11-18 11:27:54 dovecot_login authenticator failed for ([103.50.5.94]) [103.50.5.94]:50563: 535 Incorrect authentication data (set_id=media)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 141.98.103.162
country_id: 6290252
description:
[2025-11-18 11:27:58 -0300] info [webmaild] 141.98.103.162 - flavio.oliveira@8it.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-11-18 11:28:14 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:41516: 535 Incorrect authentication data (set_id=promo@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.135.6.10
country_id: 1814991
description:
2025-11-18 11:27:25 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:11078: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AcSyQ99Dcp+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.204.125.124
country_id: 1835841
description:
2025-11-18 11:27:31 dovecot_login authenticator failed for ([119.204.125.124]) [119.204.125.124]:61766: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-11-18 11:27:25 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:36468: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.240.215.10
country_id: 1814991
description:
2025-11-18 11:27:29 dovecot_login authenticator failed for ([222.240.215.10]) [222.240.215.10]:50471: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 11:28:28 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51537: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2025-11-18 11:28:31 dovecot_login authenticator failed for ([121.128.76.110]) [211.196.31.2]:45335: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.14.116
country_id: 1269750
description:
2025-11-18 11:29:16 dovecot_login authenticator failed for (static.ill.117.211.14.116.bsnl.co.in) [117.211.14.116]:45999: 535 Incorrect authentication data (set_id=press@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZbdER99DtL+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.186.228.106
country_id: 3923057
description:
2025-11-18 11:28:43 dovecot_login authenticator failed for (static-ip-adsl-190.186.228.106.cotas.com.bo) [190.186.228.106]:40992: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2025-11-18 11:28:43 dovecot_login authenticator failed for ([45.115.173.11]) [45.115.173.11]:42116: 535 Incorrect authentication data (set_id=promo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 11:29:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@f5assessoria.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<t54NSd9DBN6kXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2025-11-18 11:29:13 dovecot_login authenticator failed for (241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:55226: 535 Incorrect authentication data (set_id=info@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.228.234
country_id: 1269750
description:
2025-11-18 11:29:16 dovecot_login authenticator failed for (nsg-static-234.228.76.182-airtel.com) [182.76.228.234]:50954: 535 Incorrect authentication data (set_id=team@maringaparts.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<keHPSt9D/t+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 18 11:29:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<z9ANS99DPtYkMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.47
country_id: 1168579
description:
2025-11-18 11:29:58 dovecot_login authenticator failed for (47.92.zcomnetworks.com.pk) [103.148.92.47]:43361: 535 Incorrect authentication data (set_id=team)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-11-18 11:29:58 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:43680: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-11-18 11:29:25 dovecot_login authenticator failed for ([94.131.211.168]) [94.131.211.168]:51582: 535 Incorrect authentication data (set_id=press)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-11-18 11:29:27 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:16461: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2difTN9DAICxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.213.235.123
country_id: 1605651
description:
Nov 18 11:30:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@profetizandoasmulheres.com.br>, method=PLAIN, rip=8.213.235.123, lip=200.150.196.245, session=<BupeTd9DmpsI1et7>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.206.136
country_id: 1835841
description:
2025-11-18 11:30:33 dovecot_login authenticator failed for ([14.37.206.136]) [14.37.206.136]:52687: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.244.34
country_id: 1269750
description:
2025-11-18 11:30:44 dovecot_login authenticator failed for (nsg-corporate-34.244.186.122.airtel.in) [122.186.244.34]:51676: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.75.92.136
country_id: 1814991
description:
2025-11-18 11:31:01 dovecot_login authenticator failed for ([159.75.92.136]) [159.75.92.136]:53010: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.126.65.71
country_id: 6251999
description:
2025-11-18 11:31:10 dovecot_login authenticator failed for ([216.126.65.71]) [216.126.65.71]:43987: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 11:30:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<+Q51Td9DSodSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-11-18 11:30:20 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:52772: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2KNlTt9DpJKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 11:32:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@primiciapersianas.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<ADpZVN9DNNikXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 11:31:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@f5assessoria.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<ZGopUd9DGOx2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2025-11-18 11:31:25 dovecot_login authenticator failed for ([112.196.52.107]) [112.196.52.107]:43950: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.95.221
country_id: 2017370
description:
2025-11-18 11:31:46 dovecot_login authenticator failed for broadband-178-140-95-221.ip.moscow.rt.ru [178.140.95.221]:49705: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 11:32:12 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:60708: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.189.195
country_id: 1643084
description:
2025-11-18 11:31:24 dovecot_login authenticator failed for ([202.179.189.195]) [202.179.189.195]:14357: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.140.171
country_id: 1880251
description:
2025-11-18 11:31:35 dovecot_login authenticator failed for (171.140.212.218.starhub.net.sg) [218.212.140.171]:22973: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 216.238.113.176
country_id: 3469034
description:
Nov 18 11:31:41 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=216.238.113.176, lip=200.150.196.245, TLS, session=<to2CUt9DPtzY7nGw>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.161.84.204
country_id: 1814991
description:
2025-11-18 11:31:51 dovecot_login authenticator failed for ([123.161.84.204]) [123.161.84.204]:9074: 535 Incorrect authentication data (set_id=newsletter@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.46
country_id: 1269750
description:
2025-11-18 11:32:04 dovecot_login authenticator failed for ([182.79.95.231]) [152.52.244.46]:53948: 535 Incorrect authentication data (set_id=newsletter)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 11:31:31 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:56202: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Hxf+Ud9DTLKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.69.160
country_id: 1814991
description:
2025-11-18 11:32:09 dovecot_login authenticator failed for ([111.26.69.159]) [111.26.69.160]:46856: 535 Incorrect authentication data (set_id=billing@maringaparts.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<O/yWVd9DrtGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-11-18 11:32:52 dovecot_login authenticator failed for ([203.172.213.166]) [203.172.213.166]:35688: 535 Incorrect authentication data (set_id=orders)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.240.215.10
country_id: 1814991
description:
2025-11-18 11:33:13 dovecot_login authenticator failed for ([222.240.215.10]) [222.240.215.10]:52157: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 11:32:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@alcantaraemonteiro.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<UqSWVN9DXL6kXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2025-11-18 11:32:24 dovecot_login authenticator failed for ([218.22.187.70]) [218.22.187.66]:34404: 535 Incorrect authentication data (set_id=billing)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rKlTV99D5tyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.151.32.99
country_id: 6252001
description:
2025-11-18 11:33:07 dovecot_login authenticator failed for c-76-151-32-99.hsd1.md.comcast.net [76.151.32.99]:60510: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.209.102
country_id: 2017370
description:
2025-11-18 11:32:35 dovecot_login authenticator failed for 95-31-209-102.broadband.corbina.ru [95.31.209.102]:52668: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2025-11-18 11:32:37 dovecot_login authenticator failed for 146.47.246.220.static.netvigator.com [220.246.47.146]:61560: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.250.42
country_id: 3996063
description:
2025-11-18 11:32:51 dovecot_login authenticator failed for (201.173.250.42-clientes-izzi.mx) [201.173.250.42]:42506: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.219.196.17
country_id: 690791
description:
2025-11-18 11:33:15 dovecot_login authenticator failed for ([91.219.196.17]) [91.219.196.17]:58460: 535 Incorrect authentication data (set_id=hello@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.67.36
country_id: 1814991
description:
2025-11-18 11:32:22 dovecot_login authenticator failed for ([111.26.67.35]) [111.26.67.36]:52750: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2025-11-18 11:32:40 dovecot_login authenticator failed for ([1.237.155.150]) [1.237.155.150]:60562: 535 Incorrect authentication data (set_id=orders@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.131
country_id: 1835841
description:
2025-11-18 11:32:56 dovecot_login authenticator failed for ([1.235.192.131]) [1.235.192.131]:41361: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.149.213.8
country_id: 6252001
description:
2025-11-18 11:33:26 dovecot_login authenticator failed for ([168.149.213.8]) [168.149.213.8]:46161: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-11-18 11:33:41 dovecot_login authenticator failed for (hfce-201-183-225-156.customer.claro.com.ec) [201.183.225.156]:36339: 535 Incorrect authentication data (set_id=hello)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-11-18 11:33:49 dovecot_login authenticator failed for ([125.20.228.146]) [125.20.228.146]:35256: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.142
country_id: 3469034
description:
2025-11-18 11:33:53 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:19004: 535 Incorrect authentication data (set_id=mensagemde@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 11:34:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@fernandotonet.com.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<GK0eW99D6NakXLll>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.236.243.254
country_id: 1880251
description:
Nov 18 11:34:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@missgospel.com>, method=PLAIN, rip=47.236.243.254, lip=200.150.196.245, session=<5Z9UW99DRIkv7PP+>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AiweWd9DqImxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.76.4.158
country_id: 2017370
description:
2025-11-18 11:34:03 dovecot_login authenticator failed for (pppoe-87-76-4.158.evolife.su) [87.76.4.158]:60520: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 115.71.238.4
country_id: 1835841
description:
Nov 18 11:34:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@toromartelinho.com.br>, method=PLAIN, rip=115.71.238.4, lip=200.150.196.245, session=<VmZiW99DBodzR+4E>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.16.91
country_id: 1880251
description:
2025-11-18 11:35:15 dovecot_login authenticator failed for ([202.156.16.91]) [202.156.16.91]:51229: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.83
country_id: 1814991
description:
2025-11-18 11:34:47 dovecot_login authenticator failed for ([36.135.62.83]) [36.135.62.83]:54792: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.225.220
country_id: 1269750
description:
2025-11-18 11:34:55 dovecot_login authenticator failed for (nsg-corporate-220.225.187.122.airtel.in) [122.187.225.220]:58464: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-11-18 11:35:01 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:49386: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.95.198.138
country_id: 1269750
description:
2025-11-18 11:35:01 dovecot_login authenticator failed for (dsl-kk-static-static-138.198.95.61.airtelbroadband.in) [61.95.198.138]:36948: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.41.173.77
country_id: 3017382
description:
2025-11-18 11:34:40 dovecot_login authenticator failed for 77-173-41-213.cust.keyyo.net [213.41.173.77]:40185: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2025-11-18 11:35:14 dovecot_login authenticator failed for 80-98-157-37.dyn.estpak.ee [37.157.98.80]:57057: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.82.247.216
country_id: 1835841
description:
2025-11-18 11:34:20 dovecot_login authenticator failed for ([220.82.247.216]) [220.82.247.216]:59520: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HBS9XN9DVqGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 11:34:34 dovecot_login authenticator failed for (User) [177.74.174.120]:54571: 535 Incorrect authentication data (set_id=juliana@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 11:34:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@bethelpaintinginc.com>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<YfDQXN9DWd93xBIC>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IP8OYt9Dvs6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 11:36:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<ioTRYt9DYN4XXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2025-11-18 11:35:31 dovecot_login authenticator failed for ([50.187.155.130]) [50.187.155.130]:42865: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
country_id: 1835841
description:
2025-11-18 11:35:59 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:57828: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2025-11-18 11:35:45 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:39273: 535 Incorrect authentication data (set_id=info@adlondrina.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 177.16.29.122
country_id: 3469034
description:
[2025-11-18 11:36:14 -0300] info [webmaild] 177.16.29.122 - compras@arkson.com.br "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.32.144.232
country_id: 6252001
description:
2025-11-18 11:35:21 dovecot_login authenticator failed for (syn-065-032-144-232.res.spectrum.com) [65.32.144.232]:57428: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uJ5LYN9DNr+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 11:36:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<RUThZN9DCpHSchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.178.80
country_id: 3194884
description:
Nov 18 11:37:15 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<comercial@silvamarcenaria.com.br>, method=PLAIN, rip=37.221.178.80, lip=200.150.196.245, TLS, session=<s4xcZd9DcKcl3bJQ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2025-11-18 11:36:28 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:50878: 535 Incorrect authentication data (set_id=info@radiosarabrasil.fm.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:36:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Yz/mY99Dht6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.72.185.80
country_id: 3469034
description:
Nov 18 11:36:40 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<compras>, method=PLAIN, rip=177.72.185.80, lip=200.150.196.245, TLS, session=<7cJRY99DS5WxSLlQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 11:36:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@friendlyhand.org>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<wO63ZN9DxoEtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.228
country_id: 99237
description:
2025-11-18 11:37:05 dovecot_login authenticator failed for ([65.20.205.228]) [65.20.205.228]:36100: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.123
country_id: 1819730
description:
2025-11-18 11:37:15 dovecot_login authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:64100: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.190.155.43
country_id: 6252001
description:
2025-11-18 11:36:42 dovecot_plain authenticator failed for (prolots) [76.190.155.43]:49020: 535 Incorrect authentication data (set_id=design.user.sales@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2025-11-18 11:36:47 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:57522: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-11-18 11:36:47 dovecot_plain authenticator failed for (tarcae) [65.20.149.93]:36591: 535 Incorrect authentication data (set_id=design.user.sales@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.32
country_id: 1668284
description:
2025-11-18 11:37:23 dovecot_login authenticator failed for 221-120-4-32.emome-ip.hinet.net [221.120.4.32]:32914: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xsFvZ99DAo6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.41.142.164
country_id: 1835841
description:
2025-11-18 11:37:37 dovecot_login authenticator failed for ([118.41.142.164]) [118.41.142.164]:49331: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 77.76.128.35
country_id: 732800
description:
Nov 18 11:37:50 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<comercial>, method=PLAIN, rip=77.76.128.35, lip=200.150.196.245, TLS, session=<L2YwZ99D071NTIAj>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.119.19.172
country_id: 2510769
description:
2025-11-18 11:37:50 dovecot_login authenticator failed for ([93.119.19.172]) [93.119.19.172]:56552: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YfQGa99DsKWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 11:38:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<R9klbN9DbuRA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 11:38:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<7czra99DoLxSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.111.91.69
country_id: 690791
description:
2025-11-18 11:39:19 dovecot_login authenticator failed for host-86-111-91-69.566f.la.net.ua [86.111.91.69]:49658: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2025-11-18 11:38:33 dovecot_login authenticator failed for 111-70-28-243.emome-ip.hinet.net [111.70.28.243]:48511: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.229.202.197
country_id: 3175395
description:
2025-11-18 11:38:45 dovecot_login authenticator failed for host-95-229-202-197.business.telecomitalia.it [95.229.202.197]:49088: 535 Incorrect authentication data (set_id=help@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2025-11-18 11:38:46 dovecot_login authenticator failed for ([182.95.52.194]) [182.95.52.194]:56846: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8QnWbN9DLLqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.65.138
country_id: 1269750
description:
2025-11-18 11:38:44 dovecot_login authenticator failed for ([27.124.65.138]) [27.124.65.138]:53285: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.130.207.177
country_id: 597427
description:
2025-11-18 11:38:55 dovecot_login authenticator failed for static-213-130-207-177.cust.tele2.lt [213.130.207.177]:41902: 535 Incorrect authentication data (set_id=help)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.165
country_id: 3686110
description:
2025-11-18 11:38:55 dovecot_login authenticator failed for ([186.97.203.165]) [186.97.203.165]:54706: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.29.192
country_id: 294640
description:
2025-11-18 11:39:01 dovecot_login authenticator failed for ([95.35.29.192]) [95.35.29.192]:42033: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.171.226
country_id: 2017370
description:
2025-11-18 11:39:08 dovecot_login authenticator failed for ([83.239.171.226]) [83.239.171.226]:51582: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
country_id: 1835841
description:
2025-11-18 11:39:22 dovecot_login authenticator failed for ([121.135.188.125]) [121.135.188.125]:44642: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DbWSbt9DFsixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.231.202
country_id: 1269750
description:
2025-11-18 11:39:40 dovecot_login authenticator failed for ([152.52.231.202]) [152.52.231.202]:41352: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.18.200.242
country_id: 6252001
description:
2025-11-18 11:39:45 dovecot_login authenticator failed for ool-2f12c8f2.dyn.optonline.net [47.18.200.242]:55440: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 11:39:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dradienecougo.com>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<RoKSb99DqOzBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.3.36.154
country_id: 298795
description:
2025-11-18 11:40:33 dovecot_login authenticator failed for (95.3.36.154.static.ttnet.com.tr) [95.3.36.154]:41607: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.199.98
country_id: 2077456
description:
2025-11-18 11:41:02 dovecot_login authenticator failed for 111-220-199-98.dyn.ip.vocus.au [111.220.199.98]:47618: 535 Incorrect authentication data (set_id=paulo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.201.94
country_id: 1269750
description:
2025-11-18 11:40:39 dovecot_login authenticator failed for ([117.248.201.94]) [117.248.201.94]:44860: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2025-11-18 11:40:45 dovecot_login authenticator failed for ([188.126.240.80]) [188.126.240.80]:53086: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.3.246
country_id: 3017382
description:
2025-11-18 11:40:56 dovecot_login authenticator failed for ([188.231.3.246]) [188.231.3.246]:57392: 535 Incorrect authentication data (set_id=paulo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 11:41:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@oabsjp.org.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=<oLhXdN9DVsp2wSaf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 18 11:41:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<xzqddN9Dgt/SchJs>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Pxcvct9DbOexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.161.93.53
country_id: 1269750
description:
2025-11-18 11:40:47 dovecot_login authenticator failed for ([103.161.93.53]) [103.161.93.53]:7172: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
country_id: 1835841
description:
2025-11-18 11:41:10 dovecot_login authenticator failed for ([182.227.214.33]) [182.227.214.33]:33014: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.119
country_id: 1269750
description:
2025-11-18 11:40:37 dovecot_login authenticator failed for (nsg-corporate-119.229.187.122.airtel.in) [122.187.229.119]:37617: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 11:40:50 dovecot_login authenticator failed for (User) [177.74.174.120]:57341: 535 Incorrect authentication data (set_id=juliana@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.142
country_id: 3469034
description:
2025-11-18 11:41:06 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18825: 535 Incorrect authentication data (set_id=sharon@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0z+Jd99DqqexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.176.252
country_id: 1814991
description:
2025-11-18 11:42:18 dovecot_login authenticator failed for ([61.184.176.252]) [61.184.176.252]:34359: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.79.255.104
country_id: 2017370
description:
2025-11-18 11:41:21 dovecot_login authenticator failed for ([37.79.255.104]) [37.79.255.104]:60147: 535 Incorrect authentication data (set_id=help@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-18 11:41:23 dovecot_login authenticator failed for (User) [177.74.174.120]:57341: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.203.70.75
country_id: 3374766
description:
2025-11-18 11:41:23 dovecot_login authenticator failed for ([154.203.70.75]) [154.203.70.75]:45492: 535 Incorrect authentication data (set_id=paulo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.89.122
country_id: 1814991
description:
2025-11-18 11:41:22 dovecot_login authenticator failed for ([60.216.89.122]) [60.216.89.122]:60320: 535 Incorrect authentication data (set_id=paulo)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KZnDdd9DOJaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-11-18 11:41:37 dovecot_login authenticator failed for ([61.72.59.106]) [61.72.59.106]:39230: 535 Incorrect authentication data (set_id=help)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-18 11:42:02 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:59657: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.206.136
country_id: 1835841
description:
2025-11-18 11:43:01 dovecot_login authenticator failed for ([14.37.206.136]) [14.37.206.136]:57993: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.50.100.146
country_id: 2077456
description:
2025-11-18 11:43:09 dovecot_login authenticator failed for 146.100.50.210.sta.wbroadband.net.au [210.50.100.146]:33077: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.3
country_id: 1668284
description:
2025-11-18 11:43:13 dovecot_login authenticator failed for 111-70-32-3.emome-ip.hinet.net [111.70.32.3]:54605: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<CmJXed9D+rWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-11-18 11:42:38 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:51805: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.12
country_id: 99237
description:
2025-11-18 11:42:49 dovecot_login authenticator failed for ([65.20.191.12]) [65.20.191.12]:38203: 535 Incorrect authentication data (set_id=it@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.169.45.158
country_id: 6252001
description:
2025-11-18 11:42:59 dovecot_login authenticator failed for 158.45.169.34.bc.googleusercontent.com (7.26.82.34.bc.googleusercontent.com) [34.169.45.158]:14938: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.128.158.111
country_id: 2017370
description:
2025-11-18 11:42:55 dovecot_login authenticator failed for ([31.128.158.111]) [31.128.158.111]:49694: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2025-11-18 11:42:55 dovecot_login authenticator failed for ([36.39.140.2]) [36.39.140.2]:34385: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.79.87.53
country_id: 6252001
description:
2025-11-18 11:43:15 dovecot_login authenticator failed for wsip-174-79-87-53.br.br.cox.net [174.79.87.53]:51138: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.87.186
country_id: 1814991
description:
2025-11-18 11:43:16 dovecot_login authenticator failed for ([118.122.87.186]) [118.122.87.186]:55570: 535 Incorrect authentication data (set_id=salamuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.219.232.34
country_id: 1835841
description:
2025-11-18 11:44:07 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:33897: 535 Incorrect authentication data (set_id=salamuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.111.183.30
country_id: 1814991
description:
2025-11-18 11:44:16 dovecot_login authenticator failed for ([202.111.183.30]) [202.111.183.30]:36542: 535 Incorrect authentication data (set_id=offers)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dx7rfN9DzuKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.50.250.189
country_id: 3686110
description:
2025-11-18 11:43:50 dovecot_login authenticator failed for (dynamic-ip-181500250189.cable.net.co) [181.50.250.189]:48602: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.123.116.93
country_id: 1814991
description:
2025-11-18 11:43:54 dovecot_login authenticator failed for ([118.123.116.93]) [118.123.116.93]:37738: 535 Incorrect authentication data (set_id=offers@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.15.96.26
country_id: 3469034
description:
2025-11-18 11:44:05 dovecot_login authenticator failed for ([190.15.98.153]) [190.15.96.26]:35498: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.140.134
country_id: 1562822
description:
2025-11-18 11:43:47 dovecot_login authenticator failed for ([171.244.140.134]) [171.244.140.134]:36388: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-18 11:43:56 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:49528: 535 Incorrect authentication data (set_id=test@jacgeneralcleaning.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 18 11:44:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<8YVXgd9DiL0+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Nov 18 11:45:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=<X6j9gt9DJJHBHmEh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.84.188.140
country_id: 3996063
description:
2025-11-18 11:44:25 dovecot_login authenticator failed for ([140.84.188.140]) [140.84.188.140]:44786: 535 Incorrect authentication data (set_id=salamuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.246.227
country_id: 1814991
description:
2025-11-18 11:44:30 dovecot_login authenticator failed for ([111.53.246.227]) [111.53.246.227]:56437: 535 Incorrect authentication data (set_id=aginfo@transol.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Ps92gN9DOpexV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gjg/gt9DlqKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 11:45:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@friendlyhand.org>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<Jw4igt9DOJt3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.66.185.88
country_id: 2017370
description:
2025-11-18 11:44:21 dovecot_login authenticator failed for ([178.66.185.88]) [178.66.185.88]:49206: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 11:44:41 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<Wo3ogN9DiMgtPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-11-18 11:44:52 dovecot_login authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:47412: 535 Incorrect authentication data (set_id=aginfo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.30.97.33
country_id: 272103
description:
Nov 18 11:45:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=193.30.97.33, lip=200.150.196.245, session=<LPgEg99DDpLBHmEh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 11:46:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ministeriofernandabrum.com>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<BSJ5ht9DpuZAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.71.244
country_id: 3469034
description:
2025-11-18 11:45:59 dovecot_login authenticator failed for (177-44-71-244.ija-wr.mastercabo.com.br) [177.44.71.244]:51222: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2025-11-18 11:46:05 dovecot_plain authenticator failed for (sphabled) [65.20.184.80]:43755: 535 Incorrect authentication data (set_id=support@palestrantexavier.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.62.51
country_id: 1269750
description:
2025-11-18 11:46:10 dovecot_login authenticator failed for ([103.29.62.51]) [103.29.62.51]:59680: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.31
country_id: 2750405
description:
2025-11-18 11:46:17 dovecot_login authenticator failed for ([45.148.10.31]) [45.148.10.31]:62685: 535 Incorrect authentication data (set_id=design)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<m/IRhN9Dxq+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 11:45:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@implementarconsultoria.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<+KQehN9DTI9CYSpH>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MJWfh99D+s2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.142
country_id: 3469034
description:
2025-11-18 11:46:33 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18966: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 11:46:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<nmRtiN9DQtEv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.226.255.240
country_id: 1835841
description:
2025-11-18 11:46:47 dovecot_login authenticator failed for ([58.226.255.240]) [58.226.255.240]:2281: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2025-11-18 11:47:12 dovecot_login authenticator failed for (m121-202-146-144.smartone.com) [121.202.146.144]:39706: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.26
country_id: 2750405
description:
2025-11-18 11:46:26 dovecot_login authenticator failed for ([45.148.10.26]) [45.148.10.26]:62564: 535 Incorrect authentication data (set_id=1234)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.88
country_id: 1814991
description:
2025-11-18 11:46:42 dovecot_login authenticator failed for ([27.24.141.88]) [27.24.141.88]:52488: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.232.12.113
country_id: 1814991
description:
2025-11-18 11:46:43 dovecot_login authenticator failed for ([116.232.12.113]) [116.232.12.113]:15458: 535 Incorrect authentication data (set_id=promo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.30
country_id: 2750405
description:
2025-11-18 11:46:51 dovecot_login authenticator failed for ([45.148.10.30]) [45.148.10.30]:53516: 535 Incorrect authentication data (set_id=bounce)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 11:47:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<GAV/id9Dfq9xoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.139.162
country_id: 6252001
description:
2025-11-18 11:47:11 dovecot_login authenticator failed for (syn-072-239-139-162.res.spectrum.com) [72.239.139.162]:44280: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-18 11:46:28 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:59518: 535 Incorrect authentication data (set_id=promo@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-11-18 11:47:25 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:34836: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.21.209.27
country_id: 1814991
description:
2025-11-18 11:47:49 dovecot_login authenticator failed for ([60.21.209.27]) [60.21.209.27]:62473: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
country_id: 1269750
description:
2025-11-18 11:48:01 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:46084: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.105.219
country_id: 1269750
description:
2025-11-18 11:47:40 dovecot_login authenticator failed for (abts-mum-static-219.105.170.122.airtelbroadband.in) [122.170.105.219]:33396: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 11:47:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<9hSii99DMqZo7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7SYAjd9D9I2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.167.203.56
country_id: 1814991
description:
2025-11-18 11:47:28 dovecot_login authenticator failed for ([223.167.203.56]) [223.167.203.56]:51782: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:47:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kV48i99DZIKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 18 11:47:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<DV9Ni99DvMNSnOdL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<K2nDjt9DPqKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.67.122.230
country_id: 1835841
description:
2025-11-18 11:48:51 dovecot_login authenticator failed for ([220.67.122.230]) [220.67.122.230]:56522: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.185.101
country_id: 2921044
description:
Nov 18 11:48:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@oabsjp.org.br>, method=PLAIN, rip=164.92.185.101, lip=200.150.196.245, session=<6bwgkN9DMuykXLll>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.128.93.57
country_id: 2635167
description:
2025-11-18 11:49:02 dovecot_login authenticator failed for host86-128-93-57.range86-128.btcentralplus.com [86.128.93.57]:56332: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 11:48:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<RA54jt9DVONA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 11:49:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@iemif.org>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<THMqkt9DluXBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.146.49.206
country_id: 6252001
description:
2025-11-18 11:49:42 dovecot_login authenticator failed for ([216.146.49.206]) [216.146.49.206]:58428: 535 Incorrect authentication data (set_id=it@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.153.164.122
country_id: 1814991
description:
2025-11-18 11:49:54 dovecot_login authenticator failed for ([36.153.164.122]) [36.153.164.122]:32889: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gSthkt9Dir6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.142
country_id: 3469034
description:
2025-11-18 11:49:49 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18193: 535 Incorrect authentication data (set_id=nfe@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.25
country_id: 2750405
description:
2025-11-18 11:49:27 dovecot_login authenticator failed for ([45.148.10.25]) [45.148.10.25]:58968: 535 Incorrect authentication data (set_id=michael)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 18 11:49:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<zVyAk99DHsNxoZB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 18 11:49:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<E5spkt9D0No7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.87
country_id: 2750405
description:
2025-11-18 11:49:31 dovecot_login authenticator failed for ([45.148.10.87]) [45.148.10.87]:50392: 535 Incorrect authentication data (set_id=stores)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.29
country_id: 2750405
description:
2025-11-18 11:49:46 dovecot_login authenticator failed for ([45.148.10.29]) [45.148.10.29]:61648: 535 Incorrect authentication data (set_id=agenda)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 11:50:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<LHRelN9D7ox9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.36
country_id: 2750405
description:
2025-11-18 11:50:18 dovecot_login authenticator failed for ([45.148.10.36]) [45.148.10.36]:56943: 535 Incorrect authentication data (set_id=nas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.39
country_id: 2750405
description:
2025-11-18 11:49:27 dovecot_login authenticator failed for ([45.148.10.39]) [45.148.10.39]:59117: 535 Incorrect authentication data (set_id=email)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VYvrld9DROCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.244.44
country_id: 2017370
description:
2025-11-18 11:50:37 dovecot_login authenticator failed for ([95.181.244.44]) [95.181.244.44]:59618: 535 Incorrect authentication data (set_id=hr@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.132.129.251
country_id: 1814991
description:
2025-11-18 11:50:42 dovecot_login authenticator failed for ([59.110.5.198]) [36.132.129.251]:6315: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2025-11-18 11:50:41 dovecot_login authenticator failed for ([59.23.3.146]) [59.23.3.146]:43982: 535 Incorrect authentication data (set_id=news)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2025-11-18 11:50:46 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:38664: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dP+8l99D9OuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.34
country_id: 2750405
description:
2025-11-18 11:51:14 dovecot_login authenticator failed for ([45.148.10.34]) [45.148.10.34]:54905: 535 Incorrect authentication data (set_id=doquynhtrang)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.142
country_id: 3469034
description:
2025-11-18 11:50:50 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18470: 535 Incorrect authentication data (set_id=compras1@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.158.142.39
country_id: 690791
description:
2025-11-18 11:50:26 dovecot_login authenticator failed for ([178.158.142.39]) [178.158.142.39]:33468: 535 Incorrect authentication data (set_id=news@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 11:50:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<5K0jlt9D1vevfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.16.71.254
country_id: 6252001
description:
2025-11-18 11:50:50 dovecot_login authenticator failed for ([209.16.71.254]) [209.16.71.254]:62656: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 18 11:51:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<EBWZl99DbAxo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.88.97.102
country_id: 3469034
description:
2025-11-18 11:51:09 dovecot_login authenticator failed for ([201.88.97.102]) [201.88.97.102]:43694: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<V+9+md9DzJGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.142
country_id: 3469034
description:
2025-11-18 11:51:26 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18184: 535 Incorrect authentication data (set_id=pcp@betmetalurgica.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.251.44.210
country_id: 6252001
description:
Nov 18 11:53:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=47.251.44.210, lip=200.150.196.245, session=<R1G3nt9DhuQv+yzS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2025-11-18 11:53:03 dovecot_login authenticator failed for (static-ip-1815407040.cable.net.co) [181.54.70.40]:59446: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 11:52:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<mVuZnN9DOJFrhr+5>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<jZ0cnd9DdLGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2025-11-18 11:52:53 dovecot_login authenticator failed for h79-138-90-195.cust.bredband2.com [79.138.90.195]:56426: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
country_id: 1269750
description:
2025-11-18 11:53:20 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:49726: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.212.198.226
country_id: 1814991
description:
2025-11-18 11:53:50 dovecot_login authenticator failed for ([27.212.198.226]) [27.212.198.226]:38753: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-18 11:53:55 dovecot_plain authenticator failed for (temee) [178.250.191.189]:38544: 535 Incorrect authentication data (set_id=marcoaurelio.vendas@maringatruckparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.64
country_id: 2750405
description:
2025-11-18 11:53:40 dovecot_login authenticator failed for ([45.148.10.64]) [45.148.10.64]:63766: 535 Incorrect authentication data (set_id=noc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.201.209.152
country_id: 6252001
description:
2025-11-18 11:53:51 dovecot_login authenticator failed for mobile-166-201-209-152.mycingular.net [166.201.209.152]:54169: 535 Incorrect authentication data (set_id=tech@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 11:54:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@bethelpaintinginc.com>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<b4nYot9DhsItPZWl>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2025-11-18 11:54:11 dovecot_login authenticator failed for ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:36077: 535 Incorrect authentication data (set_id=tech)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-11-18 11:53:22 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:38039: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.37
country_id: 2750405
description:
2025-11-18 11:53:25 dovecot_login authenticator failed for ([45.148.10.37]) [45.148.10.37]:51954: 535 Incorrect authentication data (set_id=server)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8gaxoN9DFs2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.98
country_id: 2750405
description:
2025-11-18 11:54:04 dovecot_login authenticator failed for ([45.148.10.98]) [45.148.10.98]:58969: 535 Incorrect authentication data (set_id=asd)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.95.245
country_id: 3469034
description:
2025-11-18 11:54:08 dovecot_login authenticator failed for (177-174-95-245.user.vivozap.com.br) [177.174.95.245]:49312: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 11:53:19 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:62477: 535 Incorrect authentication data (set_id=webmaster@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 193.151.137.207
country_id: 130758
description:
Nov 18 11:53:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@betmetalurgica.com.br>, method=PLAIN, rip=193.151.137.207, lip=200.150.196.245, session=<nu2AoN9DEKTBl4nP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.124
country_id: 2750405
description:
2025-11-18 11:53:45 dovecot_login authenticator failed for ([45.148.10.124]) [45.148.10.124]:55950: 535 Incorrect authentication data (set_id=maria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.122
country_id: 2750405
description:
2025-11-18 11:53:26 dovecot_login authenticator failed for ([45.148.10.122]) [45.148.10.122]:54080: 535 Incorrect authentication data (set_id=ivan)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+aJ2ot9DFt+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2025-11-18 11:54:36 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:38075: 535 Incorrect authentication data (set_id=finance)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.61.149.165
country_id: 6252001
description:
Nov 18 11:55:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ceramicamonallisa.com.br>, method=PLAIN, rip=45.61.149.165, lip=200.150.196.245, session=<9bxnpt9DloQtPZWl>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 112.217.233.242
country_id: 1835841
description:
Nov 18 11:55:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@fottolegal.com.br>, method=PLAIN, rip=112.217.233.242, lip=200.150.196.245, session=<t/sBpt9DYo5w2eny>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.39.130.144
country_id: 1814991
description:
2025-11-18 11:54:28 dovecot_login authenticator failed for ([27.39.130.144]) [27.39.130.144]:36014: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.118
country_id: 2750405
description:
2025-11-18 11:54:51 dovecot_login authenticator failed for ([45.148.10.118]) [45.148.10.118]:62510: 535 Incorrect authentication data (set_id=amministrazione)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2025-11-18 11:54:56 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:40929: 535 Incorrect authentication data (set_id=paulo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-11-18 11:54:24 dovecot_login authenticator failed for (static.bb.btd.59.99.153.21.bsnl.in) [59.99.153.21]:25771: 535 Incorrect authentication data (set_id=finance@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.51.34.229
country_id: 2510769
description:
2025-11-18 11:54:28 dovecot_login authenticator failed for (229.34.51.212.dynamic.reverse-mundo-r.com) [212.51.34.229]:58752: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DKlApN9DFIKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.116.125.239
country_id: 2017370
description:
2025-11-18 11:55:15 dovecot_login authenticator failed for ([85.116.125.239]) [85.116.125.239]:42636: 535 Incorrect authentication data (set_id=secretaria)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 18 11:55:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<IvDPpt9DDM59gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2025-11-18 11:54:47 dovecot_login authenticator failed for (sulindustrial.com) [61.50.119.110]:14166: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.104.142
country_id: 2077456
description:
2025-11-18 11:54:56 dovecot_login authenticator failed for ([123.209.104.142]) [123.209.104.142]:37988: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 34.76.134.123
country_id: 2802361
description:
Nov 18 11:54:56 hosting pure-ftpd: (?@34.76.134.123) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.34
country_id: 1269750
description:
2025-11-18 11:55:04 dovecot_login authenticator failed for ([152.52.234.232]) [103.251.31.34]:44604: 535 Incorrect authentication data (set_id=secretaria@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 11:55:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ufadville.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<2LqLqN9D9tVCYSpH>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.23.244.39
country_id: 6252001
description:
Nov 18 11:55:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@palestrantexavier.com.br>, method=PLAIN, rip=64.23.244.39, lip=200.150.196.245, session=<PgdFqd9DLsNAF/Qn>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.166.87.145
country_id: 1814991
description:
2025-11-18 11:55:59 dovecot_login authenticator failed for ([223.166.87.145]) [223.166.87.145]:54428: 535 Incorrect authentication data (set_id=billing@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Zm/Lp99DdKexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.120
country_id: 2750405
description:
2025-11-18 11:55:34 dovecot_login authenticator failed for ([45.148.10.120]) [45.148.10.120]:54958: 535 Incorrect authentication data (set_id=exadmin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.97
country_id: 2750405
description:
2025-11-18 11:55:44 dovecot_login authenticator failed for ([45.148.10.97]) [45.148.10.97]:59354: 535 Incorrect authentication data (set_id=111)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KdUrrd9D7NWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 11:57:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<EbBsrd9DMZR3xBIC>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 11:57:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@portaldascontempladas.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<MxClrd9D+IGkXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.157.254.194
country_id: 2017370
description:
2025-11-18 11:57:17 dovecot_login authenticator failed for ([93.157.254.194]) [93.157.254.194]:42638: 535 Incorrect authentication data (set_id=press@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-18 11:56:21 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:41404: 535 Incorrect authentication data (set_id=billing)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xVRmq99DhMOxV3kv>


plugin: ossec
rule: 5706
name: SSH insecure connection attempt (scan).
abuser: 162.216.149.170
country_id: 6252001
description:
Nov 18 11:56:52 hosting sshd[5755]: Did not receive identification string from 162.216.149.170 port 64500


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.35
country_id: 2750405
description:
2025-11-18 11:57:41 dovecot_login authenticator failed for ([45.148.10.35]) [45.148.10.35]:59916: 535 Incorrect authentication data (set_id=kontakt)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8777rt9DgOKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.44
country_id: 2750405
description:
2025-11-18 11:57:40 dovecot_login authenticator failed for ([45.148.10.44]) [45.148.10.44]:49159: 535 Incorrect authentication data (set_id=billing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2025-11-18 11:57:43 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:52190: 535 Incorrect authentication data (set_id=feedback@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.122
country_id: 1668284
description:
2025-11-18 11:57:56 dovecot_login authenticator failed for 111-70-3-122.emome-ip.hinet.net [111.70.3.122]:51029: 535 Incorrect authentication data (set_id=feedback)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-11-18 11:58:00 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:47592: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 18 11:57:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<hRqOrt9DwOq317Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.193.134
country_id: 1269750
description:
2025-11-18 11:57:33 dovecot_login authenticator failed for ([122.175.193.134]) [122.175.193.134]:57688: 535 Incorrect authentication data (set_id=press)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
country_id: 1835841
description:
2025-11-18 11:58:30 dovecot_login authenticator failed for ([121.160.166.161]) [121.160.166.161]:58356: 535 Incorrect authentication data (set_id=info@educacionalevangelico.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-11-18 11:58:37 dovecot_login authenticator failed for ([14.98.28.43]) [14.98.28.43]:39416: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2025-11-18 11:58:40 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:42390: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.89.108
country_id: 1814991
description:
2025-11-18 11:58:45 dovecot_login authenticator failed for ([183.249.89.108]) [183.249.89.108]:48723: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.170.40.231
country_id: 2017370
description:
2025-11-18 11:58:50 dovecot_login authenticator failed for ([188.170.40.231]) [188.170.40.231]:35412: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2025-11-18 11:59:10 dovecot_login authenticator failed for ([180.71.9.31]) [180.71.9.31]:50340: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.69
country_id: 2750405
description:
2025-11-18 11:58:23 dovecot_login authenticator failed for ([45.148.10.69]) [45.148.10.69]:64902: 535 Incorrect authentication data (set_id=camara)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7raGst9DYpWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.154.62.229
country_id: 1835841
description:
2025-11-18 11:59:02 dovecot_login authenticator failed for ([125.154.62.229]) [125.154.62.229]:44522: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.199.161.79
country_id: 597427
description:
2025-11-18 11:58:25 dovecot_login authenticator failed for ip-5-199-161-79.010.ptr.cherryservers.net [5.199.161.79]:38348: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.19.168.104
country_id: 2017370
description:
2025-11-18 11:59:47 dovecot_login authenticator failed for ([94.19.168.104]) [94.19.168.104]:59098: 535 Incorrect authentication data (set_id=partners@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
country_id: 1835841
description:
2025-11-18 11:59:53 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:34149: 535 Incorrect authentication data (set_id=info@1075fm.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DfPmt99DisOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 107.134.191.185
country_id: 6252001
description:
Nov 18 12:00:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=107.134.191.185, lip=200.150.196.245, session=<P1vIuN9DBtlrhr+5>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 11:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JnUhtt9DkraxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 119.196.18.2
country_id: 1835841
description:
Nov 18 11:59:51 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ceramicamonallisa.com.br>, method=PLAIN, rip=119.196.18.2, lip=200.150.196.245, session=<iScmt99DM4l3xBIC>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2025-11-18 12:00:00 dovecot_login authenticator failed for ([220.118.190.204]) [220.118.190.204]:45907: 535 Incorrect authentication data (set_id=partners)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2025-11-18 12:00:04 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.99.95
country_id: 3469034
description:
2025-11-18 11:59:30 dovecot_login authenticator failed for (ecosistemas.static.gvt.net.br) [177.159.99.95]:48612: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.37.100.53
country_id: 1814991
description:
2025-11-18 12:00:57 dovecot_login authenticator failed for ([58.37.100.53]) [58.37.100.53]:51516: 535 Incorrect authentication data (set_id=toro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
country_id: 1814991
description:
2025-11-18 12:01:03 dovecot_login authenticator failed for ([112.6.73.140]) [221.2.40.10]:53665: 535 Incorrect authentication data (set_id=rene@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.33.253
country_id: 6290252
description:
2025-11-18 12:00:23 dovecot_login authenticator failed for (dyn-33-253.kbcnet.rs) [109.207.33.253]:37774: 535 Incorrect authentication data (set_id=toro@toromartelinho.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uem1ud9D9texV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.95.120
country_id: 1814991
description:
2025-11-18 12:00:32 dovecot_login authenticator failed for ([111.26.95.120]) [111.26.95.120]:34462: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-18 12:00:39 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:34148: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.119
country_id: 2750405
description:
2025-11-18 12:00:53 dovecot_login authenticator failed for ([45.148.10.119]) [45.148.10.119]:64265: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dIJHvd9DFISxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.17.38
country_id: 3469034
description:
2025-11-18 12:01:32 dovecot_login authenticator failed for ([186.239.246.145]) [187.8.17.38]:37542: 535 Incorrect authentication data (set_id=rene)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 12:01:45 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:62425: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 18 12:01:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@highqualityautoparts.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<iBoKvt9DbuM+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-11-18 12:02:02 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:54705: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.90.246
country_id: 690791
description:
2025-11-18 12:02:07 dovecot_plain authenticator failed for (miateny) [178.16.90.246]:34178: 535 Incorrect authentication data (set_id=novidadevida@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 66.97.42.71
country_id: 3865483
description:
Nov 18 12:02:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@lixadorajl.com.br>, method=PLAIN, rip=66.97.42.71, lip=200.150.196.245, session=<1p96v99DeKpCYSpH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.77.211.101
country_id: 1819730
description:
2025-11-18 12:02:23 dovecot_login authenticator failed for (host-by.00.net) [103.77.211.101]:50269: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HSuqwt9DlLexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 18 12:02:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<avfrv99D5JsXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.64.207.52
country_id: 6252001
description:
2025-11-18 12:02:48 dovecot_login authenticator failed for c-75-64-207-52.hsd1.la.comcast.net [75.64.207.52]:49727: 535 Incorrect authentication data (set_id=legal@maringaparts.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 191.177.160.64
country_id: 3469034
description:
[2025-11-18 12:02:52 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "GET /cpsess2402986023/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.177.160.64
country_id: 3469034
description:
[2025-11-18 12:02:59 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<CAXVwN9DDqixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.212.92
country_id: 2017370
description:
2025-11-18 12:02:32 dovecot_login authenticator failed for broadband-178-140-212-92.ip.moscow.rt.ru [178.140.212.92]:52764: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 47.79.88.199
country_id: 1861060
description:
Nov 18 12:02:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fourps.com.br>, method=PLAIN, rip=47.79.88.199, lip=200.150.196.245, session=<zni6wd9DFKUvT1jH>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-18 12:02:48 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:53790: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 164.92.94.204
country_id: 6252001
description:
Nov 18 12:02:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fottolegal.com.br>, method=PLAIN, rip=164.92.94.204, lip=200.150.196.245, session=<uRRMwt9DnJikXF7M>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.161
country_id: 1814991
description:
2025-11-18 12:03:05 dovecot_login authenticator failed for ([112.102.48.161]) [112.102.48.161]:47217: 535 Incorrect authentication data (set_id=legal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2025-11-18 12:03:40 dovecot_login authenticator failed for host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:49008: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.216.40.228
country_id: 1861060
description:
Nov 18 12:03:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=8.216.40.228, lip=200.150.196.245, session=<nAerxd9DgusI2Cjk>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.221.168
country_id: 6252001
description:
2025-11-18 12:04:06 dovecot_login authenticator failed for wsip-70-183-221-168.br.br.cox.net [70.183.221.168]:65161: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.137.151.93
country_id: 1814991
description:
2025-11-18 12:04:09 dovecot_login authenticator failed for ([180.137.151.93]) [180.137.151.93]:53805: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.182.65.40
country_id: 3017382
description:
2025-11-18 12:03:20 dovecot_login authenticator failed for 40.ip-217-182-65.eu [217.182.65.40]:59192: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.51.87.9
country_id: 1814991
description:
2025-11-18 12:03:30 dovecot_login authenticator failed for ([59.51.87.9]) [59.51.87.9]:42381: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2025-11-18 12:03:52 dovecot_login authenticator failed for ([121.159.71.249]) [121.159.71.249]:47574: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FIRnxN9DIs2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.203
country_id: 2186224
description:
2025-11-18 12:03:32 dovecot_login authenticator failed for ([121.73.169.203]) [121.73.169.203]:57482: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.122.195.14
country_id: 2017370
description:
2025-11-18 12:03:48 dovecot_login authenticator failed for 62-122-195-14.broadband.opcom.ru [62.122.195.14]:48626: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.29.136
country_id: 2017370
description:
2025-11-18 12:03:24 dovecot_login authenticator failed for ([31.173.29.136]) [31.173.29.136]:56348: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-11-18 12:03:41 dovecot_login authenticator failed for ([125.20.228.146]) [125.20.228.146]:56646: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.77.182
country_id: 1269750
description:
2025-11-18 12:04:06 dovecot_login authenticator failed for ([14.97.77.182]) [14.97.77.182]:56926: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.66.185.88
country_id: 2017370
description:
2025-11-18 12:04:57 dovecot_login authenticator failed for ([178.66.185.88]) [178.66.185.88]:49230: 535 Incorrect authentication data (set_id=sac@compensadosparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.142.48.143
country_id: 2017370
description:
2025-11-18 12:04:43 dovecot_plain authenticator failed for (ovorbated) [213.142.48.143]:45008: 535 Incorrect authentication data (set_id=e2f63808kof@89fmjoinville.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-18 12:05:09 H=(195.3.134.135) [179.0.178.53]:57317 F=<erictremblaysi@hotmail.com> rejected RCPT <fanatef@fanatef.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:57317 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.90.176
country_id: 690791
description:
2025-11-18 12:04:26 dovecot_plain authenticator failed for (phydis) [178.16.90.176]:53502: 535 Incorrect authentication data (set_id=jomma@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.232
country_id: 2186224
description:
2025-11-18 12:04:26 dovecot_login authenticator failed for ([121.73.163.232]) [121.73.163.232]:60084: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 18 12:04:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<NKZvx99DkJCl0xnK>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:04:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rwAIyN9DIICxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.191.136.142
country_id: 3469034
description:
2025-11-18 12:04:36 dovecot_login authenticator failed for (ADMIN) [181.191.136.142]:18412: 535 Incorrect authentication data (set_id=financeiro@asscar.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:06:03 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Tilmzd9DCLKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.115.48.179
country_id: 1522867
description:
Nov 18 12:06:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=82.115.48.179, lip=200.150.196.245, session=<gBZZzd9DGLZSczCz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.192.57.118
country_id: 1880251
description:
2025-11-18 12:05:26 dovecot_login authenticator failed for (bb151-192-57-118.singnet.com.sg) [151.192.57.118]:52232: 535 Incorrect authentication data (set_id=sac)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6AiXy99DgJyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 18 12:05:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<TpDWy99DkjWvfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 18 12:06:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<up6Z0N9DKKJA44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EbYnz99DgsGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 118.193.38.159
country_id: 1819730
description:
Nov 18 12:06:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@primiciapersianas.com.br>, method=PLAIN, rip=118.193.38.159, lip=200.150.196.245, session=</84Uz99DEot2wSaf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-18 12:06:50 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:63771: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<asy10t9D+uWxV3kv>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 186.249.235.228
country_id: 3469034
description:
2025-11-18 12:07:35 H=(localhost) [186.249.235.228]:14707 F=<hello@localhost> rejected RCPT <5GLmoFPeGor4H6W@transol.com.br>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.135
country_id: 2017370
description:
2025-11-18 12:07:55 dovecot_login authenticator failed for ([178.178.194.135]) [178.178.194.135]:55638: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.135.6.10
country_id: 1814991
description:
2025-11-18 12:08:36 dovecot_login authenticator failed for ([117.135.6.10]) [117.135.6.10]:49636: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-11-18 12:08:38 dovecot_login authenticator failed for ([182.95.57.158]) [182.95.57.158]:34220: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2025-11-18 12:08:46 dovecot_login authenticator failed for ([64.53.7.231]) [64.53.7.231]:37268: 535 Incorrect authentication data (set_id=media@maringaparts.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 43.157.34.94
country_id: 2921044
description:
2025-11-18 12:08:52 H=(200.150.196.245) [43.157.34.94]:57846 F=<pjqizbiolw@outlook.com> rejected RCPT <mariacecilia@adlondrina.com.br>: "JunkMail rejected - (200.150.196.245) [43.157.34.94]:57846 is in an RBL: Blocked - see https://www.spamcop.net/bl.shtml?43.157.34.94"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.18
country_id: 1269750
description:
2025-11-18 12:09:04 dovecot_login authenticator failed for ([152.52.234.33]) [182.95.174.18]:48718: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HEFO1t9DqKexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.249.19.34
country_id: 1643084
description:
2025-11-18 12:08:51 dovecot_login authenticator failed for ([103.249.19.34]) [103.249.19.34]:47198: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cMge2N9DcryxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-18 12:09:13 dovecot_login authenticator failed for (radiosarabrasil.fm.br) [112.122.54.54]:63070: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 121.237.178.133
country_id: 1814991
description:
Nov 18 12:08:43 hosting dovecot: pop3-login: Disconnected: Inactivity (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=121.237.178.133, lip=200.150.196.245, session=<c5ZCzN9DuqJ57bKF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.48.229.117
country_id: 3469034
description:
2025-11-18 12:09:06 dovecot_login authenticator failed for ip-179.48.229.117.fiberlinkpe.net.br (ip-179.48.229.118.fiberlinkpe.net.br) [179.48.229.117]:46448: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2025-11-18 12:09:10 dovecot_login authenticator failed for ([200.37.179.83]) [200.37.179.83]:45759: 535 Incorrect authentication data (set_id=media)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.30.253
country_id: 1814991
description:
2025-11-18 12:09:11 dovecot_login authenticator failed for ([112.27.30.253]) [112.27.30.253]:48853: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.24.40
country_id: 2017370
description:
2025-11-18 12:09:15 dovecot_login authenticator failed for (46-44-24-40.silinet.ru) [46.44.24.40]:54574: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.188.98
country_id: 1269750
description:
2025-11-18 12:08:37 dovecot_login authenticator failed for ([128.185.119.9]) [125.19.188.98]:48422: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.121.175.220
country_id: 3579143
description:
2025-11-18 12:08:44 dovecot_login authenticator failed for (client-adsl-93-121-175-220.mediaserv.net) [93.121.175.220]:55568: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-11-18 12:08:22 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:45066: 535 Incorrect authentication data (set_id=info@cieadep.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.156.1.127
country_id: 3469034
description:
2025-11-18 12:09:27 dovecot_login authenticator failed for ([38.156.1.127]) [38.156.1.127]:53052: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.75.248.46
country_id: 1814991
description:
2025-11-18 12:09:34 dovecot_login authenticator failed for ([222.75.248.46]) [222.75.248.46]:33794: 535 Incorrect authentication data (set_id=newsletter@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.40.82
country_id: 2017370
description:
2025-11-18 12:09:36 dovecot_login authenticator failed for ([46.44.40.82]) [46.44.40.82]:57058: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-18 12:09:39 dovecot_login authenticator failed for (radiosarabrasil.fm.br) [112.122.54.54]:20946: 535 Incorrect authentication data (set_id=postmaster@radiosarabrasil.fm.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.225.210.145
country_id: 1562822
description:
Nov 18 12:10:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@dlmoveis.com.br>, method=PLAIN, rip=14.225.210.145, lip=200.150.196.245, session=<by9K3N9DRKIO4dKR>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vTXd2d9DZM+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2025-11-18 12:09:39 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:39260: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-11-18 12:09:48 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:64114: 535 Incorrect authentication data (set_id=newsletter)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.65.27.43
country_id: 1814991
description:
2025-11-18 12:10:38 dovecot_login authenticator failed for ([112.65.27.43]) [112.65.27.43]:38046: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.148.10.81
country_id: 2750405
description:
2025-11-18 12:10:45 dovecot_login authenticator failed for ([45.148.10.81]) [45.148.10.81]:50433: 535 Incorrect authentication data (set_id=crm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.13.54
country_id: 1668284
description:
2025-11-18 12:10:50 dovecot_login authenticator failed for 111-70-13-54.emome-ip.hinet.net [111.70.13.54]:51022: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-18 12:10:58 H=(195.3.134.135) [179.0.178.53]:62184 F=<erictremblaysi@hotmail.com> rejected RCPT <camelo@transol.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:62184 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.80.74
country_id: 1819730
description:
2025-11-18 12:11:15 dovecot_login authenticator failed for (182.239.80.74.hk.chinamobile.com) [182.239.80.74]:37042: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 18 12:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Ir163d9DKouxV3kv>


