# incident

plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 14:56:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<vqwREs5DsoNn9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AloRE85DHp6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.54.65
country_id: 298795
description:
2025-11-17 14:56:29 dovecot_login authenticator failed for (78.186.54.65.static.ttnet.com.tr) [78.186.54.65]:42680: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6LNEEc5DpomxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 14:57:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=</H0YE85DaI+vfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2025-11-17 14:57:09 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:52497: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 14:56:28 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 14:57:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<JMCcE85DtpZ9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.177.200.26
country_id: 2017370
description:
2025-11-17 14:57:30 dovecot_login authenticator failed for ([178.177.200.26]) [178.177.200.26]:42990: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-11-17 14:57:47 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:41688: 535 Incorrect authentication data (set_id=comercial.user.ceo@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.77.184
country_id: 1269750
description:
2025-11-17 14:58:01 dovecot_login authenticator failed for (static.ftth.bgn.117.211.77.184.bsnl.in) [117.211.77.184]:59626: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-17 14:58:02 dovecot_login authenticator failed for (dsl-ncr-static-089.77.16.125.airtelbroadband.in) [122.187.220.30]:53852: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.82.9.238
country_id: 6252001
description:
2025-11-17 14:58:06 dovecot_login authenticator failed for (lixadoracuritiba.com.br) [206.82.9.238]:49411: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 14:58:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<uHvPFs5DqORxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.4.42.33
country_id: 3175395
description:
2025-11-17 14:57:17 dovecot_login authenticator failed for ([194.4.42.33]) [194.4.42.33]:59724: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<uH3gFM5DSK+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.89.87
country_id: 690791
description:
2025-11-17 14:57:50 dovecot_login authenticator failed for (host87-89-16-178.reedlan.com) [178.16.89.87]:58001: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.233
country_id: 1269750
description:
2025-11-17 14:58:15 dovecot_login authenticator failed for (nsg-corporate-233.228.187.122.airtel.in) [122.187.228.233]:40438: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.69.160
country_id: 1814991
description:
2025-11-17 14:58:54 dovecot_login authenticator failed for ([111.26.69.160]) [111.26.69.160]:36630: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 14:59:15 -0300] info [webmaild] 187.67.211.47 - comercial@huboperacoes.com "GET /cpsess5305070381/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.167.85
country_id: 6252001
description:
2025-11-17 14:58:51 dovecot_login authenticator failed for 24.115.167.85.res-cmts.mlf.ptd.net [24.115.167.85]:45889: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 14:58:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ufadville.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<4CnnF85DYJQIjQ01>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.167.33
country_id: 2186224
description:
2025-11-17 14:59:12 dovecot_login authenticator failed for ([121.73.167.33]) [121.73.167.33]:40032: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.4.120.19
country_id: 1814991
description:
2025-11-17 14:58:23 dovecot_login authenticator failed for ([111.4.120.19]) [111.4.120.19]:57054: 535 Incorrect authentication data (set_id=comercial.user.ceo)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vqxpGM5DxtaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.76.5.36
country_id: 2017370
description:
2025-11-17 14:58:43 dovecot_login authenticator failed for (pppoe-87-76-5.36.evolife.su) [87.76.5.36]:34604: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 14:58:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<RbgNGc5D7p+Gx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
country_id: 2017370
description:
2025-11-17 14:58:57 dovecot_login authenticator failed for (dialup-solikamsk-212.120.163.110.uralcom.com) [212.120.163.110]:60491: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 17 14:58:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<fc43GM5DsvWnYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.134.56
country_id: 3374766
description:
2025-11-17 14:59:15 dovecot_login authenticator failed for ([197.255.134.56]) [197.255.134.56]:44777: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.63.174
country_id: 2017370
description:
2025-11-17 14:58:31 dovecot_login authenticator failed for ([188.247.63.174]) [188.247.63.174]:33036: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 15:00:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<1cz+Hc5DLN8+PIOL>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 14:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<o+MJHM5DCIaxV3kv>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 14:59:47 -0300] info [webmaild] 187.67.211.47 - edilson.demetrio@huboperacoes.com "GET /cpsess5305070381/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-11-17 14:59:55 dovecot_login authenticator failed for ([128.185.241.106]) [182.95.54.10]:41468: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rjHHHc5DEpqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-11-17 15:00:57 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:42796: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 15:00:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<ngMZIc5DvIFA44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kLaWH85D1rCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.128.55.126
country_id: 1814991
description:
2025-11-17 15:00:34 dovecot_login authenticator failed for ([219.128.55.126]) [219.128.55.126]:36114: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 15:00:45 -0300] info [webmaild] 187.67.211.47 - edilson.demetrio@huboperacoes.com "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 15:00:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<eExuIM5DYL9xoZB3>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 15:01:28 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "POST /cpsess4680129972/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lWowI85DltaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 17 15:01:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@joelbuenoadvogados.com.br>, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=<mJsBI85D7M1nOJRs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.136.18
country_id: 3996063
description:
2025-11-17 15:02:40 dovecot_login authenticator failed for (187.161.136.18-clientes-izzi.mx) [187.161.136.18]:34218: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-11-17 15:02:45 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:57417: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<CjCEKM5DTp6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.59.34.5
country_id: 1814991
description:
2025-11-17 15:03:03 dovecot_login authenticator failed for ([113.59.34.8]) [113.59.34.5]:47782: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.105.166.200
country_id: 1814991
description:
2025-11-17 15:03:07 dovecot_login authenticator failed for ([36.105.166.200]) [36.105.166.200]:49750: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 15:02:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<ycxAJ85D7uB9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.182.111.162
country_id: 1880251
description:
2025-11-17 15:02:58 dovecot_login authenticator failed for (162.111.182.58.starhub.net.sg) [58.182.111.162]:42296: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.221.15.76
country_id: 2017370
description:
2025-11-17 15:02:58 dovecot_login authenticator failed for (83x221x15x76.dynamic.krasnodar.ertelecom.ru) [83.221.15.76]:56072: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 15:02:28 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "POST /cpsess4680129972/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bO+/Js5DapCxV3kv>


plugin: ossec
rule: 2501
name: User authentication failure.
description:
	cpanel::cpsrvd::do_token_denied("login failed", HASH(0x3e27d50), "3rdparty/roundcube/skins/elastic/watermark.html", "jupiter") called at cpsrvd.pl line 5127


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
country_id: 2017370
description:
2025-11-17 15:03:53 dovecot_login authenticator failed for (77x106x78x215.dynamic.barnaul.ertelecom.ru) [77.106.78.215]:65105: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.215.199.37
country_id: 1819730
description:
2025-11-17 15:03:36 dovecot_login authenticator failed for ([125.215.199.37]) [125.215.199.37]:56887: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 15:03:46 dovecot_login authenticator failed for (User) [177.74.174.120]:49165: 535 Incorrect authentication data (set_id=mudar@inovasite.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 15:04:11 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.238.254.156
country_id: 2661886
description:
2025-11-17 15:03:27 dovecot_login authenticator failed for 213-238-254-156.customers.ownit.se [213.238.254.156]:53682: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 15:03:28 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "POST /cpsess4680129972/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rIlUKs5DSLSxV3kv>


plugin: ossec
rule: 2501
name: User authentication failure.
description:
	cpanel::cpsrvd::do_token_denied("login failed", HASH(0x3e97648), "3rdparty/roundcube/skins/elastic/watermark.html", "jupiter") called at cpsrvd.pl line 5127


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tVXpLc5DINSxV3kv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 15:04:39 -0300] info [webmaild] 187.67.211.47 - operacoes@huboperacoes.com "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 15:05:12 -0300] info [webmaild] 187.67.211.47 - edilson.demetrio@huboperacoes.com "POST /cpsess0539136357/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 15:04:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<uU3oLM5D/rml0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.148.174.234
country_id: 2017370
description:
2025-11-17 15:04:21 dovecot_login authenticator failed for ([31.148.174.234]) [31.148.174.234]:52448: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.43.5.222
country_id: 357994
description:
2025-11-17 15:04:59 dovecot_login authenticator failed for ([195.43.5.222]) [195.43.5.222]:58445: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.128.123.34
country_id: 2017370
description:
2025-11-17 15:05:03 dovecot_login authenticator failed for (l5-128-123-34.novotelecom.ru) [5.128.123.34]:44168: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 15:04:19 dovecot_login authenticator failed for (User) [177.74.174.120]:49165: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 15:04:26 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:52295: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 15:06:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<5zY6M85DRpY+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.206.93.107
country_id: 3017382
description:
2025-11-17 15:06:14 dovecot_login authenticator failed for 107.93.206.77.rev.sfr.net [77.206.93.107]:34120: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.92
country_id: 2186224
description:
2025-11-17 15:05:26 dovecot_login authenticator failed for ([121.73.163.92]) [121.73.163.92]:39180: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UU95Mc5D4IexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 15:05:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<GlhXMs5DvsBns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7eNDM85DGqCxV3kv>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 15:06:12 -0300] info [webmaild] 187.67.211.47 - edilson.demetrio@huboperacoes.com "POST /cpsess0539136357/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.102.225
country_id: 1668284
description:
2025-11-17 15:06:00 dovecot_login authenticator failed for (180-218-102-225.dynamic.twmbroadband.net) [180.218.102.225]:43110: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.26.205.154
country_id: 1814991
description:
2025-11-17 15:06:28 dovecot_login authenticator failed for (154.205.26.218.internet.sx.cn) [218.26.205.154]:45308: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<iGUFNc5D0K+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.245.7
country_id: 3469034
description:
2025-11-17 15:06:50 dovecot_plain authenticator failed for ([192.168.1.13]) [104.28.245.7]:32900: 535 Incorrect authentication data (set_id=contato@acmesolar.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 187.67.211.47
country_id: 3469034
description:
[2025-11-17 15:07:12 -0300] info [webmaild] 187.67.211.47 - edilson.demetrio@huboperacoes.com "POST /cpsess0539136357/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.205.20.70
country_id: 6251999
description:
2025-11-17 15:08:10 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:57725: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XDmeOM5DMNGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 15:08:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<iveaO85DXIUnaoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 17 15:08:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<JpXLO85DRLU+PIOJ>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FnczPM5DhuuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
country_id: 1835841
description:
2025-11-17 15:08:46 dovecot_login authenticator failed for ([39.125.67.109]) [39.125.67.109]:46869: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2025-11-17 15:08:58 dovecot_login authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:59466: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.119
country_id: 1814991
description:
2025-11-17 15:08:57 dovecot_login authenticator failed for ([27.24.141.119]) [27.24.141.119]:33314: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<56kCPs5DEpCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-17 15:09:05 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:56142: 535 Incorrect authentication data (set_id=processos.daniel@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2025-11-17 15:08:43 dovecot_login authenticator failed for (syn-184-057-039-170.res.spectrum.com) [184.57.39.170]:64983: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.79
country_id: 1814991
description:
2025-11-17 15:09:05 dovecot_login authenticator failed for ([36.135.62.79]) [36.135.62.79]:58180: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-11-17 15:09:12 dovecot_login authenticator failed for ([46.8.246.27]) [46.8.246.27]:59198: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 15:10:00 dovecot_login authenticator failed for (User) [177.74.174.120]:51743: 535 Incorrect authentication data (set_id=mudar@inovasite.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 15:10:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<jCm/Qc5DFt2l0xnK>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 189.40.71.97
country_id: 3469034
description:
[2025-11-17 15:10:07 -0300] info [webmaild] 189.40.71.97 - contato@palestrantexavier.com.br "GET /cpsess9327661840/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kQzAP85DsJ+xV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YeFUQ85DpMKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 15:10:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<FjOGQ85DlIMnaoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 17 15:10:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<4HGWQ85DtNI7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 15:10:16 dovecot_login authenticator failed for (User) [177.74.174.120]:51743: 535 Incorrect authentication data (set_id=mudar@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2025-11-17 15:11:45 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:33371: 535 Incorrect authentication data (set_id=info.user.ceo)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YRGxSM5DaoexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.169.28.244
country_id: 2017370
description:
2025-11-17 15:12:11 dovecot_login authenticator failed for 28.244.inn361.ru [193.169.28.244]:50799: 535 Incorrect authentication data (set_id=vendas.pedro@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-17 15:11:16 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:57248: 535 Incorrect authentication data (set_id=andre.nascimento.ceo@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-11-17 15:11:27 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:49376: 535 Incorrect authentication data (set_id=info.user.ceo@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-11-17 15:11:29 dovecot_login authenticator failed for (186.235.248.73.girardi-rs.com.br) [186.235.248.73]:36960: 535 Incorrect authentication data (set_id=andre.nascimento.ceo)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3nHsRs5D9uOxV3kv>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 189.40.71.97
country_id: 3469034
description:
[2025-11-17 15:11:33 -0300] info [webmaild] 189.40.71.97 - contato@palestrantexavier.com.br "GET /cpsess9327661840/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.181.100.133
country_id: 3865483
description:
Nov 17 15:11:48 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<novidadevida>, method=PLAIN, rip=190.181.100.133, lip=200.150.196.245, TLS, session=<25/QRs5DtLG+tWSF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.143.104
country_id: 2077456
description:
2025-11-17 15:12:27 dovecot_login authenticator failed for ([120.157.143.104]) [120.157.143.104]:60480: 535 Incorrect authentication data (set_id=vendas.pedro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Nz6ESs5D2pexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.115.88
country_id: 1814991
description:
2025-11-17 15:12:54 dovecot_login authenticator failed for ([183.6.115.88]) [183.6.115.88]:56026: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.209.29
country_id: 1562822
description:
2025-11-17 15:13:13 dovecot_login authenticator failed for ([113.160.209.29]) [113.160.209.29]:45542: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dKAOTs5DoL2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 15:14:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<GIctUM5DcrkXXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<V8pxU85DGu2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-11-17 15:14:25 dovecot_login authenticator failed for ([125.20.228.146]) [125.20.228.146]:59974: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FhyiUc5D0t+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2025-11-17 15:14:53 dovecot_login authenticator failed for ([65.20.170.59]) [65.20.170.59]:40500: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.205.104
country_id: 2017370
description:
2025-11-17 15:15:25 dovecot_login authenticator failed for ([88.84.205.104]) [88.84.205.104]:48798: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UQZBVc5D3I2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-11-17 15:15:42 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:54466: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.65.30
country_id: 2264397
description:
2025-11-17 15:15:52 dovecot_login authenticator failed for bl23-65-30.dsl.telepac.pt [144.64.65.30]:3729: 535 Incorrect authentication data (set_id=gerson.comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.188
country_id: 3996063
description:
2025-11-17 15:15:59 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:44437: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.33.248
country_id: 6290252
description:
2025-11-17 15:16:11 dovecot_login authenticator failed for (dyn-33-248.kbcnet.rs) [109.207.33.248]:41719: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-11-17 15:15:40 dovecot_login authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:59362: 535 Incorrect authentication data (set_id=gerson.comercial@sulindustrial.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.213.189.27
country_id: 3144096
description:
2025-11-17 15:15:45 dovecot_login authenticator failed for (cm-84.213.189.27.get.no) [84.213.189.27]:47481: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 17 15:15:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<Mt5OVs5Dvee317Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.119.153.105
country_id: 1835841
description:
2025-11-17 15:16:35 dovecot_login authenticator failed for ([220.119.153.105]) [220.119.153.105]:50720: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-11-17 15:16:36 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:49754: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.172.135.11
country_id: 6252001
description:
2025-11-17 15:17:07 dovecot_plain authenticator failed for ([107.172.135.11]) [107.172.135.11]:52577: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.5.113.133
country_id: 3865483
description:
2025-11-17 15:16:21 dovecot_login authenticator failed for (host133.advance.com.ar) [200.5.113.133]:14294: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ghjPWM5D3LCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 117.217.120.52
country_id: 1269750
description:
Nov 17 15:17:14 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@globalmedica.com.br>, method=PLAIN, rip=117.217.120.52, lip=200.150.196.245, TLS, session=<rXz4Wc5DItx12Xg0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.99
country_id: 6252001
description:
2025-11-17 15:17:21 dovecot_login authenticator failed for ([70.174.168.99]) [70.174.168.99]:58793: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 15:17:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<oD8JXM5Dzq5o7MS0>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Y+JnXM5DSNaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.171.226
country_id: 2017370
description:
2025-11-17 15:17:58 dovecot_login authenticator failed for ([83.239.171.226]) [83.239.171.226]:38775: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UB0nXs5DUuSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 15:17:30 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:54041: 535 Incorrect authentication data (set_id=test@jacgeneralcleaning.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 71.41.202.12
country_id: 6252001
description:
Nov 17 15:17:34 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=71.41.202.12, lip=200.150.196.245, TLS, session=<18pmW85DOqNHKcoM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-17 15:17:39 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:39936: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 15:17:54 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50074: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.193.187
country_id: 1814991
description:
2025-11-17 15:18:10 dovecot_login authenticator failed for ([59.46.193.187]) [59.46.193.187]:49165: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<82v2X85DyIqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 15:18:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<ndOgX85DetCGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.179.135.174
country_id: 2661886
description:
2025-11-17 15:20:09 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:41742: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2025-11-17 15:20:14 dovecot_login authenticator failed for (customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:2114: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mDyEY85DXLCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 15:19:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<QBB4Y85DZIVA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2025-11-17 15:19:51 dovecot_login authenticator failed for 89-67-38-27.dynamic.play.pl [89.67.38.27]:43500: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.3.39
country_id: 1819730
description:
2025-11-17 15:19:59 dovecot_login authenticator failed for ([84.54.3.39]) [84.54.3.39]:33816: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2025-11-17 15:20:30 dovecot_login authenticator failed for ([61.72.58.242]) [61.72.58.242]:37747: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-11-17 15:20:53 dovecot_login authenticator failed for ([111.93.177.228]) [111.93.177.228]:56506: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-17 15:21:05 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:57882: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 17 15:21:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@huboperacoes.com>, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=<FvsXac5DsNdnOJRs>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<JwEYZ85DLNOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 15:20:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<ke2mZ85Dbqlo7MS0>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 15:20:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<NRTlZ85D9qgkMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.208
country_id: 732800
description:
2025-11-17 15:21:03 dovecot_login authenticator failed for (151.237.115.208.pronet.bg) [151.237.115.208]:40925: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hWXoaM5DMuCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-11-17 15:21:31 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:35672: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 15:21:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<XB6gas5DEqPSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.212.92
country_id: 2017370
description:
2025-11-17 15:22:15 dovecot_login authenticator failed for broadband-178-140-212-92.ip.moscow.rt.ru [178.140.212.92]:54236: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.58
country_id: 1668284
description:
2025-11-17 15:21:24 dovecot_login authenticator failed for ([101.13.1.58]) [101.13.1.58]:60914: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.123
country_id: 1819730
description:
2025-11-17 15:21:26 dovecot_login authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:59958: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.170.59
country_id: 99237
description:
2025-11-17 15:21:45 dovecot_login authenticator failed for ([65.20.170.59]) [65.20.170.59]:50675: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.63.174
country_id: 2017370
description:
2025-11-17 15:21:29 dovecot_login authenticator failed for ([188.247.63.174]) [188.247.63.174]:56396: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
country_id: 2658434
description:
2025-11-17 15:21:43 dovecot_login authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:58662: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 15:21:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<v70xas5DeLmd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.64.118
country_id: 3996063
description:
2025-11-17 15:22:00 dovecot_login authenticator failed for ([201.160.64.118]) [201.160.64.118]:60405: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.33.96.3
country_id: 1835841
description:
2025-11-17 15:21:43 dovecot_login authenticator failed for ([14.33.96.3]) [14.33.96.3]:46312: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.90
country_id: 1269750
description:
2025-11-17 15:21:52 dovecot_login authenticator failed for ([182.66.81.153]) [27.123.112.90]:45174: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.36.7.89
country_id: 2017370
description:
2025-11-17 15:21:58 dovecot_login authenticator failed for ([78.36.7.89]) [78.36.7.89]:36102: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 15:22:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<b44Kbc5DRo1SnOdL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<s5+zas5D9IWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.122.103.21
country_id: 1835841
description:
2025-11-17 15:21:35 dovecot_login authenticator failed for ([222.122.103.21]) [222.122.103.21]:33460: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<L0tIbs5DDqCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 15:22:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<gng2bs5DZtNns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
country_id: 1814991
description:
2025-11-17 15:22:58 dovecot_login authenticator failed for ([39.164.91.67]) [39.164.91.67]:50468: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.116.165
country_id: 3144096
description:
2025-11-17 15:22:26 dovecot_login authenticator failed for (cm-178.232.116.165.get.no) [178.232.116.165]:35577: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.94
country_id: 6252001
description:
2025-11-17 15:22:31 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:47068: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.196.79
country_id: 290557
description:
2025-11-17 15:23:17 dovecot_login authenticator failed for ([5.30.196.79]) [5.30.196.79]:59437: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.79
country_id: 1814991
description:
2025-11-17 15:23:28 dovecot_login authenticator failed for ([36.135.62.79]) [36.135.62.79]:33368: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<85Hacc5DJsSxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BvCic85DBNaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2025-11-17 15:24:14 dovecot_login authenticator failed for ([106.0.165.219]) [106.0.165.219]:39644: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4Q1ndc5D+OmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-11-17 15:24:50 dovecot_login authenticator failed for ([152.52.199.126]) [152.52.199.126]:51810: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.193.97.116
country_id: 6252001
description:
2025-11-17 15:25:20 dovecot_login authenticator failed for ([199.193.97.116]) [199.193.97.116]:48193: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<l3z8eM5D4KyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 15:25:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<nqO4ec5DpoZn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.238.101.209
country_id: 3932488
description:
2025-11-17 15:26:02 dovecot_login authenticator failed for ([190.238.101.209]) [190.238.101.209]:55304: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 15:25:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<jkxyeM5D4JQIjQ01>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.218.26
country_id: 1269750
description:
2025-11-17 15:25:33 dovecot_login authenticator failed for (nsg-corporate-191.126.187.122.airtel.in) [182.66.218.26]:47074: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 15:25:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<MnnIec5DFi6vfiX3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 15:25:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<e/jkec5DQoPSchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 15:25:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=</6h2es5DIual0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-11-17 15:26:05 dovecot_login authenticator failed for (arpa.static.242.94.53.202.nettlinx.com) [202.53.94.242]:38568: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.238
country_id: 1668284
description:
2025-11-17 15:26:55 dovecot_login authenticator failed for 111-70-23-238.emome-ip.hinet.net [111.70.23.238]:44345: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2025-11-17 15:26:21 dovecot_login authenticator failed for (nsg-corporate-54.234.187.122.airtel.in) [122.187.234.54]:39026: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.218.37.145
country_id: 1814991
description:
2025-11-17 15:26:25 dovecot_login authenticator failed for ([111.206.233.34]) [221.218.37.145]:39943: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<roSXfM5DrMqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.197.188
country_id: 453733
description:
2025-11-17 15:26:42 dovecot_login authenticator failed for 188-197-29-85.dyn.estpak.ee [85.29.197.188]:45702: 535 Incorrect authentication data (set_id=leandro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2025-11-17 15:26:53 dovecot_login authenticator failed for (static-158.128.194.14-tataidc.co.in) [14.194.128.158]:48990: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.27.93.138
country_id: 1835841
description:
2025-11-17 15:26:33 dovecot_login authenticator failed for ([59.27.93.138]) [59.27.93.138]:45876: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.218.18
country_id: 1269750
description:
2025-11-17 15:26:49 dovecot_login authenticator failed for ([128.185.217.27]) [128.185.218.18]:39970: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0bJVfs5Dtt6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.202.61.155
country_id: 2017370
description:
2025-11-17 15:27:12 dovecot_login authenticator failed for 155-61-202-109.kamensktel.ru [109.202.61.155]:43441: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.47.2
country_id: 1269750
description:
2025-11-17 15:27:43 dovecot_login authenticator failed for ([122.184.143.81]) [182.95.47.2]:53080: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 17 15:27:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<KHkPgc5DFtynYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-11-17 15:28:05 dovecot_login authenticator failed for ([84.54.115.46]) [84.54.115.46]:58478: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-11-17 15:28:10 dovecot_login authenticator failed for (aes-static-041.100.144.59.airtel.in) [182.95.57.158]:59194: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2025-11-17 15:27:24 dovecot_login authenticator failed for ([218.156.93.202]) [218.156.93.202]:41746: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.30.205
country_id: 1269750
description:
2025-11-17 15:27:25 dovecot_login authenticator failed for ([103.248.30.205]) [103.248.30.205]:33315: 535 Incorrect authentication data (set_id=salamuni)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<aZEjgM5DuOuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.1.60.243
country_id: 1605651
description:
Nov 17 15:27:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@profetizandoasmulheres.com.br>, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=<qd1egM5DWJzSATzz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.139.37.218
country_id: 2300660
description:
Nov 17 15:29:09 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<jesse@pousadarincaoalegre.com.br>, method=PLAIN, rip=41.139.37.218, lip=200.150.196.245, TLS, session=<rXR9hM5DxZgpiyXa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.201.209.152
country_id: 6252001
description:
2025-11-17 15:28:24 dovecot_login authenticator failed for mobile-166-201-209-152.mycingular.net [166.201.209.152]:36729: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.215.205
country_id: 1819730
description:
2025-11-17 15:28:26 dovecot_login authenticator failed for (m121-202-215-205.smartone.com) [121.202.215.205]:12591: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<wvyzg85DpJ6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-17 15:28:43 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:58242: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.220.210
country_id: 2403846
description:
2025-11-17 15:28:52 dovecot_login authenticator failed for ([196.216.220.210]) [196.216.220.210]:52496: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 15:29:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@implementarconsultoria.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<RjfChc5DKOUIjQ01>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.198.128.124
country_id: 1835841
description:
2025-11-17 15:29:16 dovecot_login authenticator failed for ([211.198.128.124]) [211.198.128.124]:49464: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 15:28:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<+53dg85DVodns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.10.56.129
country_id: 1835841
description:
2025-11-17 15:29:15 dovecot_login authenticator failed for ([59.10.56.129]) [59.10.56.129]:36923: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<aBRTh85DjL6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 15:29:40 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:59228: 535 Incorrect authentication data (set_id=root@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.153.49
country_id: 1814991
description:
2025-11-17 15:30:05 dovecot_login authenticator failed for ([221.2.153.49]) [221.2.153.49]:53419: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.135.236.42
country_id: 2017370
description:
2025-11-17 15:29:35 dovecot_login authenticator failed for ([79.135.236.42]) [79.135.236.42]:54000: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.3.154.183
country_id: 2017370
description:
2025-11-17 15:29:52 dovecot_login authenticator failed for ([212.3.154.183]) [212.3.154.183]:51956: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2tYSic5DKNCxV3kv>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-17 15:30:35 H=(195.3.134.135) [179.0.178.53]:60466 F=<erictremblaysi@hotmail.com> rejected RCPT <ricardoo@globalmedica.com.br>: Nenhuma pessoa no endereço.


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 15:30:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<WOHHi85D6IKd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.132.86
country_id: 1527747
description:
2025-11-17 15:30:58 dovecot_login authenticator failed for (158.181.132.86.mega.kg) [158.181.132.86]:41001: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.210.41.172
country_id: 390903
description:
2025-11-17 15:31:07 dovecot_login authenticator failed for (149-210-41-172.mobile.nym.cosmote.net) [149.210.41.172]:58288: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dc7Zis5D2NyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-11-17 15:30:37 dovecot_login authenticator failed for ([182.95.24.209]) [182.95.57.158]:38558: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.131
country_id: 1269750
description:
Nov 17 15:30:55 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos@maringasoldas.com.br>, method=PLAIN, rip=103.18.166.131, lip=200.150.196.245, TLS, session=<3q3uis5DF7lnEqaD>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.40.114.86
country_id: 1835841
description:
2025-11-17 15:30:58 dovecot_login authenticator failed for ([14.40.114.86]) [14.40.114.86]:38818: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.53
country_id: 1668284
description:
2025-11-17 15:31:12 dovecot_login authenticator failed for 110-25-109-53.adsl.fetnet.net [110.25.109.53]:51151: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 189.63.42.143
country_id: 3469034
description:
[2025-11-17 15:31:24 -0300] info [webmaild] 189.63.42.143 - diretoria@eaglebpo.com.br "GET /cpsess6120534665/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 17 15:31:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<Zcsnjs5D8LOdQi/y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2025-11-17 15:31:29 dovecot_login authenticator failed for ([189.44.251.249]) [186.238.247.238]:35551: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 15:32:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<wggjkM5Dqr1ns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.25.50.22
country_id: 1605651
description:
2025-11-17 15:31:16 dovecot_login authenticator failed for node-9w6.pool-125-25.dynamic.nt-isp.net ([183.89.250.247]) [125.25.50.22]:51083: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MxZyjs5DiJCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.59.235.170
country_id: 1814991
description:
2025-11-17 15:31:32 dovecot_login authenticator failed for ([222.175.187.214]) [218.59.235.170]:53058: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.193.128.123
country_id: 1269750
description:
2025-11-17 15:31:32 dovecot_login authenticator failed for (nsg-corporate-6.249.186.122.airtel.in) [116.193.128.123]:55560: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.198.131.107
country_id: 6252001
description:
[2025-11-17 15:33:15 -0300] info [whostmgrd] 124.198.131.107 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:32:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BYoOks5DwNKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-11-17 15:32:46 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:44260: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 17 15:32:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<Pvgjk85DSM0zTY0d>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-11-17 15:32:59 dovecot_login authenticator failed for ([41.231.85.75]) [41.231.85.75]:38984: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WdHNk85D7OCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 15:33:13 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<nZNOlM5DJqSl0iHB>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 152.42.163.119
country_id: 1880251
description:
[2025-11-17 15:33:36 -0300] info [cpaneld] 152.42.163.119 - hoteljoi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.122.245
country_id: 1269750
description:
2025-11-17 15:33:51 dovecot_login authenticator failed for (abts-mum-static-245.122.70.182.airtelbroadband.in) [182.70.122.245]:44168: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 15:33:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<ALd4lM5DcqVA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-17 15:33:17 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:37446: 535 Incorrect authentication data (set_id=escritura1@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:33:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cHWilc5DgIGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2025-11-17 15:33:46 dovecot_login authenticator failed for ([211.104.166.110]) [211.104.166.110]:35375: 535 Incorrect authentication data (set_id=escritura1)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 15:33:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<mBLRls5DRr1n9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.224.10
country_id: 1269750
description:
2025-11-17 15:34:08 dovecot_login authenticator failed for ([125.20.224.10]) [125.20.224.10]:60880: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.107.6
country_id: 1269750
description:
2025-11-17 15:34:22 dovecot_login authenticator failed for ([182.78.107.6]) [182.78.107.6]:46220: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<FPknmc5DAKqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.166
country_id: 1269750
description:
2025-11-17 15:34:32 dovecot_login authenticator failed for ([182.95.131.41]) [103.251.31.166]:55512: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-17 15:34:55 dovecot_login authenticator failed for ([27.123.91.165]) [182.95.115.38]:35952: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+nDFnM5D3NqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.231.107.174
country_id: 1814991
description:
2025-11-17 15:35:34 dovecot_login authenticator failed for ([221.231.107.174]) [221.231.107.174]:4516: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2025-11-17 15:35:37 dovecot_login authenticator failed for (m121-202-198-98.smartone.com) [121.202.198.98]:58704: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1g6Jns5DBOuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
country_id: 458258
description:
2025-11-17 15:36:14 dovecot_login authenticator failed for ([178.250.191.189]) [178.250.191.189]:47282: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.128.93.57
country_id: 2635167
description:
2025-11-17 15:35:23 dovecot_login authenticator failed for host86-128-93-57.range86-128.btcentralplus.com [86.128.93.57]:39574: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.94.211
country_id: 1880251
description:
2025-11-17 15:35:29 dovecot_login authenticator failed for (223-25-94-211.myrepublic.com.sg) [223.25.94.211]:63942: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.45.103.11
country_id: 3469034
description:
2025-11-17 15:35:49 dovecot_login authenticator failed for (ADMIN) [187.45.103.11]:57418: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.170
country_id: 99237
description:
2025-11-17 15:35:54 dovecot_login authenticator failed for ([65.20.251.170]) [65.20.251.170]:43027: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.138.178
country_id: 1814991
description:
2025-11-17 15:36:05 dovecot_login authenticator failed for ([39.152.138.178]) [39.152.138.178]:41268: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2025-11-17 15:36:06 dovecot_login authenticator failed for ([15.218.135.58]) [15.218.135.58]:57077: 535 Incorrect authentication data (set_id=cpanel@sindeesfort.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 17 15:36:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<SMzjn85DAN6nYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.43.156
country_id: 732800
description:
2025-11-17 15:36:33 dovecot_login authenticator failed for 77-85-43-156.ip.btc-net.bg [77.85.43.156]:48790: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.15
country_id: 2186224
description:
2025-11-17 15:36:34 dovecot_login authenticator failed for ([121.73.162.15]) [121.73.162.15]:52986: 535 Incorrect authentication data (set_id=cpanel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.185.173.167
country_id: 1814991
description:
2025-11-17 15:36:48 dovecot_login authenticator failed for ([110.185.173.167]) [110.185.173.167]:36284: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.237.93
country_id: 2077456
description:
2025-11-17 15:36:22 dovecot_login authenticator failed for ([120.157.237.93]) [120.157.237.93]:35684: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.119
country_id: 1814991
description:
2025-11-17 15:36:31 dovecot_login authenticator failed for ([111.26.106.119]) [111.26.106.119]:47130: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0apZoM5DqpqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2025-11-17 15:37:03 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:50683: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rxPso85DpLqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.199.146.204
country_id: 192950
description:
2025-11-17 15:38:13 dovecot_login authenticator failed for (ADMIN) [217.199.146.204]:56350: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-11-17 15:38:09 dovecot_login authenticator failed for (static-221.76.249.49-tataidc.co.in) [49.249.76.221]:48100: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.86.130
country_id: 1269750
description:
2025-11-17 15:37:20 dovecot_login authenticator failed for ([182.76.86.130]) [182.76.86.130]:57318: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.100.41.198
country_id: 798549
description:
2025-11-17 15:37:50 dovecot_login authenticator failed for ([109.100.41.198]) [109.100.41.198]:46419: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<U8h/p85DUN6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 15:38:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<Heq6p85DeqRSnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 15:38:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<1D61qM5DDK0kMrBu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 15:39:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<nKOxqc5DJK5n9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<z3JCqc5DCOuxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 15:39:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<svErqc5DspYIjQ01>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2025-11-17 15:40:05 dovecot_login authenticator failed for (dynamic-adsl.movitel.co.mz) [197.219.210.86]:47236: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 17 15:40:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@joelbuenoadvogados.com.br>, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=<FAcmrc5DuJxnOJRs>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bGkTq85DzJKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 15:39:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<Wifpq85DOuVxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.128.7
country_id: 1814991
description:
2025-11-17 15:39:52 dovecot_login authenticator failed for ([58.17.128.7]) [58.17.128.7]:35120: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.228.32.34
country_id: 1814991
description:
2025-11-17 15:40:44 dovecot_login authenticator failed for ([124.228.32.34]) [124.228.32.34]:56595: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 15:41:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<xWlLsM5Dvsh9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.117
country_id: 1814991
description:
2025-11-17 15:41:04 dovecot_login authenticator failed for ([111.26.106.117]) [111.26.106.117]:37718: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 15:41:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<aQUKsc5DGK+Gx8nN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 15:41:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<bh8Ssc5DVOgXXz9j>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MOejrs5DbrKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 15:41:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<eWzjsc5DfmyvfiX3>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HAI+ss5DytWxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+zkGtM5DGOSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.194.136.3
country_id: 1668284
description:
2025-11-17 15:42:13 dovecot_login authenticator failed for 123-194-136-3.dynamic.kbronet.com.tw [123.194.136.3]:32984: 535 Incorrect authentication data (set_id=vendas.dilson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2025-11-17 15:41:48 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:51346: 535 Incorrect authentication data (set_id=vendas.dilson@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
country_id: 1269750
description:
2025-11-17 15:43:10 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:53595: 535 Incorrect authentication data (set_id=bianca)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 15:42:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<vX+yts5D+uhA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2025-11-17 15:42:57 dovecot_login authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:38930: 535 Incorrect authentication data (set_id=bianca@globalmedica.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<x7TGtc5DXIyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.220.255.230
country_id: 2017370
description:
2025-11-17 15:42:41 dovecot_login authenticator failed for ([83.220.255.230]) [83.220.255.230]:37775: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 14.103.168.32
country_id: 1814991
description:
Nov 17 15:42:42 hosting dovecot: pop3-login: Disconnected: Inactivity (user disabled): user=<shuf@pousadarincaoalegre.com.br>, method=PLAIN, rip=14.103.168.32, lip=200.150.196.245, session=<mAWxq85DkJYOZ6gg>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.207.33.248
country_id: 6290252
description:
2025-11-17 15:43:15 dovecot_login authenticator failed for (dyn-33-248.kbcnet.rs) [109.207.33.248]:52991: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.109.208
country_id: 1819730
description:
2025-11-17 15:42:27 dovecot_login authenticator failed for (182.239.109.208.hk.chinamobile.com) [182.239.109.208]:55010: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 15:42:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<oCp4tc5DLLZxoZB3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<M9FYuc5DtqmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.137.93.14
country_id: 1835841
description:
2025-11-17 15:43:40 dovecot_login authenticator failed for ([121.137.93.14]) [121.137.93.14]:34625: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WRn4vM5DNMyxV3kv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.66.54.66
country_id: 1643084
description:
[2025-11-17 15:44:44 -0300] info [cpaneld] 157.66.54.66 - adportobelo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adportobelo (has_cpuser_file failed)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<X6O1vs5DVN2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.40.215.162
country_id: 3469034
description:
2025-11-17 15:45:03 dovecot_login authenticator failed for 187-40-215-162.user.veloxzone.com.br [187.40.215.162]:42569: 535 Incorrect authentication data (set_id=bianca.user.finance@globalmedica.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.55.146.14
country_id: 1210997
description:
[2025-11-17 15:45:33 -0300] info [cpaneld] 103.55.146.14 - bonfitne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user bonfitne (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.55
country_id: 1819730
description:
2025-11-17 15:45:40 dovecot_login authenticator failed for (182.239.78.55.hk.chinamobile.com) [182.239.78.55]:44932: 535 Incorrect authentication data (set_id=bianca.user.finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 15:45:43 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:60226: 535 Incorrect authentication data (set_id=test@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-11-17 15:46:01 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:48530: 535 Incorrect authentication data (set_id=paulo.user.finance@louvoreterno.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<kRmFwM5DSOqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.248.250.143
country_id: 298795
description:
2025-11-17 15:47:11 dovecot_login authenticator failed for (88.248.250.143.static.ttnet.com.tr) [88.248.250.143]:35544: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-11-17 15:46:16 dovecot_login authenticator failed for (189-56-202-86.customer.tdatabrasil.net.br) [189.56.202.86]:42884: 535 Incorrect authentication data (set_id=paulo.user.finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.98
country_id: 1269750
description:
2025-11-17 15:46:25 dovecot_login authenticator failed for ([128.185.253.98]) [128.185.253.98]:38304: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 15:46:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<GF+Pw85DUs5ns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 15:46:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<ioDVw85DUKR9gnHM>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<P7IXxM5DFJ6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.81.132.114
country_id: 2264397
description:
2025-11-17 15:46:49 dovecot_login authenticator failed for bl16-132-114.dsl.telepac.pt [188.81.132.114]:51164: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<63ysx85DBLmxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Phpwyc5DvM6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.79.237
country_id: 2017370
description:
2025-11-17 15:47:27 dovecot_login authenticator failed for broadband-188-32-79-237.ip.moscow.rt.ru [188.32.79.237]:36454: 535 Incorrect authentication data (set_id=novamanha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-17 15:48:39 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:57684: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.55.31.157
country_id: 1835841
description:
2025-11-17 15:49:00 dovecot_login authenticator failed for ([14.55.31.157]) [14.55.31.157]:59014: 535 Incorrect authentication data (set_id=juridico)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 15:49:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<r1oizc5DDt6l0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 15:48:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<FJnfys5D4KgnaoFh>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<LL1Ay85DXtyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.59.235.170
country_id: 1814991
description:
2025-11-17 15:48:36 dovecot_login authenticator failed for ([222.175.187.214]) [218.59.235.170]:36874: 535 Incorrect authentication data (set_id=juridico@sindeesfort.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<m4nPzs5DdI6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.243.8.74
country_id: 6252001
description:
2025-11-17 15:50:25 dovecot_login authenticator failed for ([162.243.8.74]) [162.243.8.74]:54254: 535 Incorrect authentication data (set_id=misterthomas@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-17 15:50:36 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:49303: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.213
country_id: 2186224
description:
2025-11-17 15:51:01 dovecot_login authenticator failed for ([121.73.162.213]) [121.73.162.213]:54714: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.111.34
country_id: 1269750
description:
2025-11-17 15:50:37 dovecot_login authenticator failed for ([182.78.111.34]) [182.78.111.34]:41206: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.13.47.83
country_id: 1814991
description:
2025-11-17 15:50:39 dovecot_login authenticator failed for ([218.13.47.83]) [218.13.47.83]:58396: 535 Incorrect authentication data (set_id=misterthomas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+Uw01M5DHr2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.57.17.171
country_id: 1814991
description:
2025-11-17 15:51:11 dovecot_login authenticator failed for ([111.57.17.171]) [111.57.17.171]:42214: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.220.33.115
country_id: 2017370
description:
2025-11-17 15:51:13 dovecot_login authenticator failed for ([95.220.33.115]) [95.220.33.115]:56384: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 17 15:50:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<HyOI0c5DVoA+PIOJ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 15:50:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<SCg00s5DzLMnaoFh>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<wipk0s5DYKuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.48.70
country_id: 3469034
description:
2025-11-17 15:51:30 dovecot_login authenticator failed for ([187.12.48.70]) [187.12.48.70]:34793: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cGD11c5DasyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
country_id: 458258
description:
2025-11-17 15:52:28 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:58564: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<P4iK2c5D5IGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
country_id: 1269750
description:
2025-11-17 15:52:35 dovecot_login authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:54497: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.81.45.147
country_id: 6252001
description:
2025-11-17 15:52:35 dovecot_login authenticator failed for ([172.81.45.147]) [172.81.45.147]:47725: 535 Incorrect authentication data (set_id=comercial.user.finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.188.102.28
country_id: 298795
description:
2025-11-17 15:52:56 dovecot_login authenticator failed for (78.188.102.28.static.ttnet.com.tr) [78.188.102.28]:52014: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-17 15:52:20 dovecot_login authenticator failed for (gatecidos.static.gvt.net.br) [179.185.29.233]:35826: 535 Incorrect authentication data (set_id=comercial.user.finance@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.103.253.48
country_id: 1820814
description:
2025-11-17 15:52:22 dovecot_login authenticator failed for (48-253.adsl.static.espeed.com.bn) [118.103.253.48]:35714: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 200.66.118.88
country_id: 3469034
description:
[2025-11-17 15:54:08 -0300] info [webmaild] 200.66.118.88 - vendas@arkson.com.br "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+vki3c5DRKOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.171.226
country_id: 2017370
description:
2025-11-17 15:53:34 dovecot_login authenticator failed for ([83.239.171.226]) [83.239.171.226]:46490: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 15:53:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<wDAz3s5DMuWl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.39.201
country_id: 3144096
description:
2025-11-17 15:53:57 dovecot_login authenticator failed for (cm-46.212.39.201.get.no) [46.212.39.201]:46120: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.6.127.244
country_id: 1814991
description:
2025-11-17 15:54:00 dovecot_login authenticator failed for ([112.6.127.244]) [112.6.127.244]:50987: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TBHo3s5DBq6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.62.41
country_id: 1814991
description:
2025-11-17 15:54:59 dovecot_login authenticator failed for ([1.180.62.41]) [1.180.62.41]:52888: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 15:55:06 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:62692: 535 Incorrect authentication data (set_id=sales@jacgeneralcleaning.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.155.179
country_id: 3469034
description:
2025-11-17 15:55:08 dovecot_login authenticator failed for ([191.59.155.179]) [191.59.155.179]:56668: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 15:55:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<atMt485DqKZo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.27.93.138
country_id: 1835841
description:
2025-11-17 15:55:01 dovecot_login authenticator failed for ([59.27.93.138]) [59.27.93.138]:49754: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 17 15:55:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<CYuN4s5DJpU7GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.66.120.237
country_id: 6252001
description:
2025-11-17 15:54:17 dovecot_login authenticator failed for (209.66.120.237.IDIA-404706-ZYO.zip.zayo.com) [209.66.120.237]:40611: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UYCz4M5DPLqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.15
country_id: 2186224
description:
2025-11-17 15:54:32 dovecot_login authenticator failed for ([121.73.162.15]) [121.73.162.15]:35834: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.176.136
country_id: 6252001
description:
2025-11-17 15:54:45 dovecot_login authenticator failed for mobile-166-130-176-136.mycingular.net [166.130.176.136]:60480: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.108.14.225
country_id: 1814991
description:
2025-11-17 15:55:39 dovecot_login authenticator failed for ([202.108.14.226]) [202.108.14.225]:56068: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 15:55:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@highqualityautoparts.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<hEcT5c5DDq4+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2025-11-17 15:55:18 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:37218: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.18.186
country_id: 1269750
description:
2025-11-17 15:55:22 dovecot_login authenticator failed for ([103.140.18.186]) [103.140.18.186]:33846: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.128.123.34
country_id: 2017370
description:
2025-11-17 15:55:25 dovecot_login authenticator failed for (l5-128-123-34.novotelecom.ru) [5.128.123.34]:42938: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7vRM5M5DvNixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.115.88
country_id: 1814991
description:
2025-11-17 15:55:33 dovecot_login authenticator failed for ([183.6.115.88]) [183.6.115.88]:36229: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.212.198.51
country_id: 1814991
description:
2025-11-17 15:56:23 dovecot_login authenticator failed for ([14.212.198.51]) [14.212.198.51]:51146: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ps/V585DnIyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-11-17 15:56:38 dovecot_login authenticator failed for ([195.222.57.190]) [195.222.57.190]:46626: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NuOg6c5D2paxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 15:57:49 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:50291: 535 Incorrect authentication data (set_id=info@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.19.165.90
country_id: 3469034
description:
2025-11-17 15:57:57 dovecot_login authenticator failed for (secovi-rs.pae.gvt.net.br) [177.19.165.90]:42961: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 180.222.166.212
country_id: 2077456
description:
Nov 17 15:58:00 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=180.222.166.212, lip=200.150.196.245, TLS, session=<uYGr685DH+203qbU>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.151.6
country_id: 2661886
description:
2025-11-17 15:58:13 dovecot_login authenticator failed for h188-122-151-6.cust.bredband2.com [188.122.151.6]:55290: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.8.174
country_id: 1814991
description:
2025-11-17 15:58:14 dovecot_login authenticator failed for ([60.166.8.174]) [60.166.8.174]:44974: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<wX1q685DhKexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2025-11-17 15:57:35 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:52276: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 190.223.53.234
country_id: 3932488
description:
Nov 17 15:57:33 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@1075fm.com.br>, method=PLAIN, rip=190.223.53.234, lip=200.150.196.245, TLS, session=<WbxN6s5Do7q+3zXq>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.59.158
country_id: 2017370
description:
2025-11-17 15:57:47 dovecot_login authenticator failed for ([188.247.59.158]) [188.247.59.158]:58864: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.201.2.253
country_id: 1814991
description:
2025-11-17 15:58:26 dovecot_login authenticator failed for ([113.201.2.253]) [113.201.2.253]:31958: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 15:58:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<ARCz7s5DCkho7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<38EA785D5saxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mudm9M5Dyo6xV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 15:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mhWV8s5Dgu2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.214.110
country_id: 3703430
description:
2025-11-17 15:59:45 dovecot_login authenticator failed for (104.214.46.200.psinetpa.net) [200.46.214.110]:39764: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 15:59:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<uWnZ8s5Dnpmd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.30.248.213
country_id: 2017370
description:
2025-11-17 15:59:41 dovecot_login authenticator failed for broadband-85-30-248-213.ip.moscow.rt.ru [85.30.248.213]:49168: 535 Incorrect authentication data (set_id=presidencia)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 17 15:59:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@huboperacoes.com>, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=<X9C5885D6oVnOJRs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.33.89.47
country_id: 2635167
description:
2025-11-17 15:59:19 dovecot_login authenticator failed for ([217.33.89.47]) [217.33.89.47]:60606: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.189.80.73
country_id: 2510769
description:
2025-11-17 15:59:33 dovecot_login authenticator failed for 73.pool92-189-80.dynamic.orange.es [92.189.80.73]:63056: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 17 16:00:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<qkqi9c5DKCq317Oa>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0c4n9s5DwqyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 16:01:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<4dZh+M5DSoxA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-11-17 16:01:24 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:46235: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.219
country_id: 798544
description:
2025-11-17 16:01:51 dovecot_login authenticator failed for 89-67-37-219.dynamic.play.pl [89.67.37.219]:60065: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 16:02:01 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<ATlZ+85DcrIkMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2025-11-17 16:01:55 dovecot_login authenticator failed for ([50.247.189.189]) [50.247.189.189]:62851: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.144.37.102
country_id: 1269750
description:
2025-11-17 16:02:09 dovecot_login authenticator failed for ([103.144.37.102]) [103.144.37.102]:46234: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.235.187.158
country_id: 1814991
description:
2025-11-17 16:01:18 dovecot_login authenticator failed for ([123.235.187.158]) [123.235.187.158]:36452: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 16:01:20 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:56064: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RL3B+c5DasaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
country_id: 1269750
description:
2025-11-17 16:01:37 dovecot_login authenticator failed for (node103203210119.kkdbroadband.co.in) [103.203.210.119]:37887: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8Ggg/85DnoexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2025-11-17 16:02:40 dovecot_login authenticator failed for ([172.191.74.151]) [172.191.74.151]:48458: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.160.64.118
country_id: 3996063
description:
2025-11-17 16:02:50 dovecot_login authenticator failed for ([201.160.64.118]) [201.160.64.118]:45793: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.94.168.28
country_id: 3469034
description:
[2025-11-17 16:02:49 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.164
country_id: 1269750
description:
2025-11-17 16:02:50 dovecot_login authenticator failed for (nsg-corporate-164.227.187.122.airtel.in) [122.187.227.164]:33154: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.87.203
country_id: 1814991
description:
2025-11-17 16:03:12 dovecot_login authenticator failed for ([220.179.87.203]) [220.179.87.203]:55172: 535 Incorrect authentication data (set_id=eleicoes@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.236.158
country_id: 1269750
description:
2025-11-17 16:03:12 dovecot_login authenticator failed for ([125.19.175.68]) [152.52.236.158]:47104: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 16:02:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<MZhO/M5D8I7SchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2025-11-17 16:02:18 dovecot_login authenticator failed for ([189.108.156.41]) [187.8.64.94]:49123: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OLRS/c5DsOexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2025-11-17 16:03:19 dovecot_login authenticator failed for ([45.82.110.150]) [45.82.110.150]:46238: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.2.166.30
country_id: 2635167
description:
2025-11-17 16:03:26 dovecot_login authenticator failed for ([151.2.166.30]) [151.2.166.30]:46726: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-17 16:03:28 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:54364: 535 Incorrect authentication data (set_id=eleicoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 16:03:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<31K0AM9DnONns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<s8zpAM9DjJuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.122
country_id: 1269750
description:
2025-11-17 16:05:01 dovecot_login authenticator failed for ([128.185.80.65]) [182.95.52.122]:43976: 535 Incorrect authentication data (set_id=bruno@htmsolucoesindustriais.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 16:05:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<5JBZBs9D/J1SnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.183.135.88
country_id: 2017370
description:
2025-11-17 16:05:14 dovecot_login authenticator failed for host.46-183-135-88.broadband.redcom.ru [46.183.135.88]:44399: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 16:04:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@lixadorajl.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<BJceBM9D5J8IjQ01>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ckh5BM9DgrixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.235.248.73
country_id: 3469034
description:
2025-11-17 16:05:27 dovecot_login authenticator failed for ([186.235.248.73]) [186.235.248.73]:57714: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.202.86
country_id: 3469034
description:
2025-11-17 16:05:30 dovecot_login authenticator failed for (186-238-88-61.customer.tdatabrasil.net.br) [189.56.202.86]:35190: 535 Incorrect authentication data (set_id=bruno)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XnEOCM9D/NexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 17 16:05:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<EF1YCM9DzHynYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.2
country_id: 798544
description:
2025-11-17 16:05:51 dovecot_login authenticator failed for 89-67-37-2.dynamic.play.pl [89.67.37.2]:50678: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.198.128.124
country_id: 1835841
description:
2025-11-17 16:05:57 dovecot_login authenticator failed for ([211.198.128.124]) [211.198.128.124]:45503: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-11-17 16:06:03 dovecot_login authenticator failed for ([187.51.128.233]) [189.44.133.238]:34311: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.219.232.34
country_id: 1835841
description:
2025-11-17 16:05:27 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:51421: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
country_id: 1814991
description:
2025-11-17 16:05:29 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:31062: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.62.88
country_id: 1835841
description:
2025-11-17 16:05:40 dovecot_login authenticator failed for ([119.206.62.88]) [119.206.62.88]:33586: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-11-17 16:05:42 dovecot_login authenticator failed for ([182.79.31.107]) [152.52.199.126]:50672: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.94.168.28
country_id: 3469034
description:
[2025-11-17 16:05:49 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-11-17 16:06:02 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:45983: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.219.93.108
country_id: 357994
description:
2025-11-17 16:05:53 dovecot_login authenticator failed for ([196.219.93.108]) [196.219.93.108]:42602: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 16:05:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<+QAnCc9D2oAXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2025-11-17 16:05:34 dovecot_login authenticator failed for ([125.19.160.206]) [125.19.160.206]:60056: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<YdLUCc9DlOmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.74.74.44
country_id: 1814991
description:
2025-11-17 16:06:08 dovecot_login authenticator failed for ([39.74.74.44]) [39.74.74.44]:59308: 535 Incorrect authentication data (set_id=info.user.finance@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 16:06:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<WuWQC89Dgt3SchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-11-17 16:06:35 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:36862: 535 Incorrect authentication data (set_id=andre.nascimento.finance@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2025-11-17 16:06:37 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:47303: 535 Incorrect authentication data (set_id=info.user.finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.133.98
country_id: 1814991
description:
2025-11-17 16:06:50 dovecot_login authenticator failed for ([221.224.133.98]) [221.224.133.98]:46906: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.33.154
country_id: 1562822
description:
2025-11-17 16:07:06 dovecot_login authenticator failed for ([210.245.33.154]) [210.245.33.154]:57378: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.22.130
country_id: 1562822
description:
2025-11-17 16:06:17 dovecot_login authenticator failed for ([124.197.22.130]) [124.197.22.130]:45050: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fQqkC89DqouxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.72.6.162
country_id: 1668284
description:
2025-11-17 16:06:53 dovecot_login authenticator failed for ([192.72.6.162]) [192.72.6.162]:48003: 535 Incorrect authentication data (set_id=andre.nascimento.finance)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.78.112.81
country_id: 1814991
description:
2025-11-17 16:06:18 dovecot_login authenticator failed for ([218.78.112.81]) [218.78.112.81]:60334: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.86.221.69
country_id: 2017370
description:
2025-11-17 16:06:36 dovecot_login authenticator failed for ([88.86.221.69]) [88.86.221.69]:59108: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 16:08:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@implementarconsultoria.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<oU+mEc9DxuYIjQ01>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.1.60.243
country_id: 1605651
description:
Nov 17 16:07:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@profetizandoasmulheres.com.br>, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=<VSmLDs9DwIfSATzz>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AgQ4D89DMK6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 16:08:00 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<WbW6EM9DbrZn9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Yc+OFM9DEt6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 16:08:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<e3HJEc9DAKad5hjP>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4vHDEs9DJMqxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+5ZcFs9DFuyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 16:09:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<KrGdFs9DDKOl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.81.209.76
country_id: 2017370
description:
2025-11-17 16:10:11 dovecot_login authenticator failed for ([78.81.209.76]) [78.81.209.76]:43756: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 16:09:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<J1QAFs9DJpdns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.116
country_id: 1269750
description:
2025-11-17 16:10:39 dovecot_login authenticator failed for (nsg-corporate-116.230.187.122.airtel.in) [122.187.230.116]:55166: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2025-11-17 16:10:42 dovecot_login authenticator failed for ([122.184.124.46]) [122.184.124.46]:42378: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.50.167.81
country_id: 1269750
description:
2025-11-17 16:11:03 dovecot_login authenticator failed for ([36.50.167.81]) [36.50.167.81]:36068: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<pNrwGc9DWqWxV3kv>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 189.40.71.27
country_id: 3469034
description:
[2025-11-17 16:10:36 -0300] info [webmaild] 189.40.71.27 - contato@palestrantexavier.com.br "GET /cpsess9327661840/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.235.140.163
country_id: 2017370
description:
2025-11-17 16:10:56 dovecot_login authenticator failed for (37-235-140-163.dynamic.customer.lanta.me) [37.235.140.163]:58782: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.67.36
country_id: 1814991
description:
2025-11-17 16:10:26 dovecot_login authenticator failed for ([111.26.67.35]) [111.26.67.36]:40122: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.170.26.169
country_id: 2077456
description:
2025-11-17 16:10:33 dovecot_login authenticator failed for (124-170-26-169.tpgi.com.au) [124.170.26.169]:49775: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.104.76.94
country_id: 1835841
description:
2025-11-17 16:11:54 dovecot_login authenticator failed for ([222.104.76.94]) [222.104.76.94]:50542: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<p8BQH89DWs+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.197.198.89
country_id: 1814991
description:
2025-11-17 16:12:15 dovecot_login authenticator failed for ([47.98.191.121]) [115.197.198.89]:50668: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 189.40.71.27
country_id: 3469034
description:
[2025-11-17 16:11:26 -0300] info [webmaild] 189.40.71.27 - contato@palestrantexavier.com.br "GET /cpsess9327661840/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<wFqHHc9DsMKxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:13:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<88WuJM9DlpCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.206.226.8
country_id: 2017370
description:
2025-11-17 16:13:52 dovecot_login authenticator failed for ([178.206.226.8]) [178.206.226.8]:54734: 535 Incorrect authentication data (set_id=vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.122
country_id: 1668284
description:
2025-11-17 16:13:10 dovecot_login authenticator failed for 111-70-3-122.emome-ip.hinet.net [111.70.3.122]:53540: 535 Incorrect authentication data (set_id=vendas@arkson.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 17 16:14:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<EbsXJ89DVs0zTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 37.221.142.123
country_id: 690791
description:
Nov 17 16:14:29 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos@maringasoldas.com.br>, method=PLAIN, rip=37.221.142.123, lip=200.150.196.245, TLS, session=<ppLJJs9DD6Il3Y57>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:14:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<e+tCKM9DgLWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-17 16:14:36 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:53070: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 16:14:42 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:56436: 535 Incorrect authentication data (set_id=sales@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.133.10.204
country_id: 1814991
description:
2025-11-17 16:14:45 dovecot_login authenticator failed for ([61.133.10.205]) [61.133.10.204]:56080: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 16:14:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<B+PkKM9DpIlA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.59.158
country_id: 2017370
description:
2025-11-17 16:14:25 dovecot_login authenticator failed for ([188.247.59.158]) [188.247.59.158]:40120: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 17 16:14:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<mmS9J89D+AanYwhf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<dqEHKs9DKMCxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<pMbMK89DJtKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.85
country_id: 1814991
description:
2025-11-17 16:15:36 dovecot_login authenticator failed for ([111.26.63.84]) [111.26.63.85]:47712: 535 Incorrect authentication data (set_id=igreja)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 17 16:15:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<dMQqLM9DTJqdQi/y>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 16:15:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<z4QqLc9DhNxn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.229.128.251
country_id: 2017370
description:
2025-11-17 16:15:58 dovecot_login authenticator failed for ([46.229.128.251]) [46.229.128.251]:49222: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
country_id: 1814991
description:
2025-11-17 16:16:03 dovecot_login authenticator failed for ([60.172.1.210]) [60.172.1.210]:39072: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.135.26.217
country_id: 798544
description:
2025-11-17 16:15:16 dovecot_login authenticator failed for ([31.135.26.217]) [31.135.26.217]:39412: 535 Incorrect authentication data (set_id=igreja@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-17 16:16:13 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:53038: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.61.40.117
country_id: 3469034
description:
2025-11-17 16:16:23 dovecot_login authenticator failed for 201-61-40-117.bbone.telesp.net.br ([186.200.154.89]) [201.61.40.117]:51241: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.186
country_id: 1269750
description:
2025-11-17 16:16:29 dovecot_login authenticator failed for ([182.95.49.186]) [182.95.49.186]:33228: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0mtiL89DJIKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.5.83.207
country_id: 2017370
description:
2025-11-17 16:16:36 dovecot_login authenticator failed for 81.5.83.207.dhcp.mipt-telecom.ru [81.5.83.207]:52605: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.169.77
country_id: 3469034
description:
2025-11-17 16:16:54 dovecot_login authenticator failed for 179-125-169-77.static.desktop.com.br [179.125.169.77]:58754: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Gxf3Ms9DGKyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.83.41.60
country_id: 3469034
description:
2025-11-17 16:17:51 dovecot_login authenticator failed for (170-83-41-60.swtelecom.com.br) [170.83.41.60]:42835: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2025-11-17 16:17:09 dovecot_login authenticator failed for ([95.79.108.51]) [95.79.108.51]:46065: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.150.115
country_id: 1819730
description:
2025-11-17 16:17:21 dovecot_login authenticator failed for 115.150.48.116.static.netvigator.com [116.48.150.115]:64600: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 16:17:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<cMgRNM9DeOWl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-17 16:18:03 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:55415: 535 Incorrect authentication data (set_id=industria@vidaengenharia.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XWrANM9DhLmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-11-17 16:18:06 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:49732: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-11-17 16:17:21 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:37740: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.216.225.109
country_id: 1814991
description:
2025-11-17 16:17:40 dovecot_login authenticator failed for ([114.216.225.109]) [114.216.225.109]:2530: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 16:18:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ufadville.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<NbaTNc9DwIMIjQ01>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 41.76.80.113
country_id: 2328926
description:
Nov 17 16:18:32 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas@nextviagem.com>, method=PLAIN, rip=41.76.80.113, lip=200.150.196.245, TLS, session=<+6ZqNc9D1pIpTFBx>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2025-11-17 16:18:35 dovecot_login authenticator failed for ([187.51.128.233]) [189.44.133.238]:59555: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.65.21
country_id: 1814991
description:
2025-11-17 16:18:39 dovecot_login authenticator failed for ([183.220.65.21]) [183.220.65.21]:51070: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 31.222.12.8
country_id: 798544
description:
Nov 17 16:19:01 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<vendas>, method=PLAIN, rip=31.222.12.8, lip=200.150.196.245, TLS, session=<RaktN89DI4sf3gwI>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.59.154
country_id: 1269750
description:
2025-11-17 16:18:11 dovecot_login authenticator failed for ([182.95.25.48]) [182.95.59.154]:50950: 535 Incorrect authentication data (set_id=novamanha@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
country_id: 1814991
description:
2025-11-17 16:18:22 dovecot_login authenticator failed for ([120.224.15.67]) [120.224.15.67]:15306: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OM6ENs9D0M6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.220.47.242
country_id: 2017370
description:
2025-11-17 16:18:33 dovecot_login authenticator failed for ([95.220.47.242]) [95.220.47.242]:59290: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-11-17 16:18:45 dovecot_login authenticator failed for ([46.8.246.27]) [46.8.246.27]:41552: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 16:19:21 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<Qko+Oc9DlrYkMrBu>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<87oXOs9DWumxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 17 16:19:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@joelbuenoadvogados.com.br>, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=<Cs9/OM9DSsNnOJRs>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-17 16:19:06 H=(195.3.134.135) [179.0.178.53]:51472 F=<erictremblaysi@hotmail.com> rejected RCPT <contagui@contagui.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:51472 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.16.71.254
country_id: 6252001
description:
2025-11-17 16:19:12 dovecot_login authenticator failed for ([209.16.71.254]) [209.16.71.254]:62112: 535 Incorrect authentication data (set_id=novamanha)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6DG3Pc9DRqexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 16:20:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<9baTPs9DWr1n9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<iQl1P89DyrixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.219.232.34
country_id: 1835841
description:
2025-11-17 16:21:51 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:40488: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.97.146
country_id: 1562822
description:
2025-11-17 16:22:04 dovecot_login authenticator failed for (adsl.viettel.vn) [115.77.97.146]:51858: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 16:21:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<Yr7XP89Dar5xoZB3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xCZKQc9DgMmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 16:21:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<S59GQc9DYoFSnOdL>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 16:21:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<lDHGQc9DcLo+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
country_id: 1819730
description:
2025-11-17 16:21:47 dovecot_login authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:37447: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.41.217
country_id: 2077456
description:
2025-11-17 16:22:10 dovecot_login authenticator failed for 110-175-41-217.static.tpgi.com.au [110.175.41.217]:37953: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8/vXRM9DMOyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.185.98
country_id: 2017370
description:
2025-11-17 16:23:05 dovecot_login authenticator failed for ([217.24.185.98]) [217.24.185.98]:34146: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 16:23:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<76TzSM9DELOGx8nN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 16:23:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<cQCzSc9DhNxxoZB3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tDU4Ss9D3K6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-11-17 16:23:05 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:59375: 535 Incorrect authentication data (set_id=loopert@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2025-11-17 16:23:15 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:36870: 535 Incorrect authentication data (set_id=loopert)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.168.104.169
country_id: 1814991
description:
2025-11-17 16:23:20 dovecot_login authenticator failed for (pc169.zz.ha.cn) [61.168.104.169]:35276: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XdpnSM9D6JixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
country_id: 2510769
description:
2025-11-17 16:24:01 dovecot_login authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:59358: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</j75S89DkLyxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 16:24:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<gBjOS89Dpol9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-17 16:24:11 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:16442: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 16:24:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<ch7+Ss9DXoFA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.183.1
country_id: 6252001
description:
2025-11-17 16:25:11 dovecot_login authenticator failed for (ADMIN) [103.153.183.1]:62550: 535 Incorrect authentication data (set_id=contato@ilumix.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 16:25:14 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<+oFhTs9DREuvfiX3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tWeMT89Dpt+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.59.6.81
country_id: 1668284
description:
2025-11-17 16:25:56 dovecot_login authenticator failed for ([61.59.6.81]) [61.59.6.81]:54851: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.35.96.85
country_id: 2017370
description:
2025-11-17 16:27:00 dovecot_login authenticator failed for ([77.35.96.85]) [77.35.96.85]:32822: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 16:26:59 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55721: 535 Incorrect authentication data (set_id=admin@implementarconsultoria.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TiXxVM9DrKyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2025-11-17 16:26:24 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:47614: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<M5cgU89DHJyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-11-17 16:27:32 dovecot_login authenticator failed for (syn-172-248-047-114.res.spectrum.com) [172.248.47.114]:36573: 535 Incorrect authentication data (set_id=doninha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.188
country_id: 1814991
description:
2025-11-17 16:27:51 dovecot_login authenticator failed for ([27.40.100.188]) [27.40.100.188]:38698: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 16:27:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<VGpXV89DtMs+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.112.8
country_id: 1835841
description:
2025-11-17 16:27:45 dovecot_login authenticator failed for ([14.48.112.8]) [14.48.112.8]:1248: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2025-11-17 16:27:48 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:48586: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.101.217.177
country_id: 289688
description:
2025-11-17 16:27:55 dovecot_login authenticator failed for ([78.101.217.177]) [78.101.217.177]:51490: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 16:27:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<oKlGVc9DOt5ns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.212.92
country_id: 2017370
description:
2025-11-17 16:27:14 dovecot_login authenticator failed for broadband-178-140-212-92.ip.moscow.rt.ru [178.140.212.92]:54340: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.115.29.39
country_id: 1835841
description:
2025-11-17 16:27:16 dovecot_login authenticator failed for ([175.115.29.39]) [175.115.29.39]:34115: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XVS6Vs9DwLmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.201.27.64
country_id: 2029969
description:
2025-11-17 16:28:57 dovecot_login authenticator failed for ([122.201.27.64]) [122.201.27.64]:41644: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.105.153.3
country_id: 2017370
description:
2025-11-17 16:28:08 dovecot_login authenticator failed for ([89.105.153.3]) [89.105.153.3]:49729: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.127.150
country_id: 1269750
description:
2025-11-17 16:28:12 dovecot_login authenticator failed for (nsg-corporate-177.246.185.122.airtel.in) [122.184.127.150]:39282: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 16:28:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<Ed1zWc9DzOAnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
country_id: 1269750
description:
2025-11-17 16:28:27 dovecot_login authenticator failed for (node103203210119.kkdbroadband.co.in) [103.203.210.119]:34532: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<59pKWs9D+NmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.171.25
country_id: 290557
description:
2025-11-17 16:28:41 dovecot_login authenticator failed for ([87.200.171.25]) [87.200.171.25]:33202: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2025-11-17 16:28:45 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:53370: 535 Incorrect authentication data (set_id=unijovem@pibtrindade.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.120
country_id: 2510769
description:
2025-11-17 16:28:15 dovecot_login authenticator failed for ([45.136.194.120]) [45.136.194.120]:39448: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-17 16:28:58 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:51290: 535 Incorrect authentication data (set_id=unijovem)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-17 16:29:42 dovecot_login authenticator failed for (adlondrina.com.br) [112.122.54.54]:35868: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 16:29:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<V/BLX89DltN9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.40.20
country_id: 2017370
description:
2025-11-17 16:29:18 dovecot_login authenticator failed for broadband-37-110-40-20.ip.moscow.rt.ru [37.110.40.20]:57624: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:29:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OvrjXc9DbIuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-11-17 16:29:39 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:57746: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.111.140
country_id: 1269750
description:
2025-11-17 16:30:04 dovecot_login authenticator failed for (abts-mum-static-140.111.170.122.airtelbroadband.in) [122.170.111.140]:40556: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.242
country_id: 2635167
description:
Nov 17 16:29:29 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.242, lip=200.150.207.122, TLS, session=<yVO1Xc9Djc6594ny>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<LBKkX89DIpmxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 17 16:30:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<dsrNX89DpOs+PIOJ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<azN0Yc9DKqqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.110.248
country_id: 1668284
description:
2025-11-17 16:30:45 dovecot_login authenticator failed for ([180.218.110.248]) [180.218.110.248]:51150: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 16:30:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<ejeoYs9DnqUXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.122.54.54
country_id: 1814991
description:
2025-11-17 16:30:07 dovecot_login authenticator failed for (adlondrina.com.br) [112.122.54.54]:1961: 535 Incorrect authentication data (set_id=postmaster@adlondrina.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2025-11-17 16:30:20 dovecot_login authenticator failed for ([50.247.189.189]) [50.247.189.189]:33514: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.151
country_id: 1668284
description:
2025-11-17 16:30:23 dovecot_login authenticator failed for 110-25-112-151.adsl.fetnet.net [110.25.112.151]:33297: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 16:30:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<FOXVYM9DYrwnaoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.223.123
country_id: 3469034
description:
2025-11-17 16:30:44 dovecot_login authenticator failed for (clinicahumanas.sdr.gvt.net.br) [177.135.223.123]:58480: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 16:31:20 dovecot_login authenticator failed for (User) [177.74.174.120]:54058: 535 Incorrect authentication data (set_id=silva@inovasite.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zkgNZc9DnsexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.191.146.98
country_id: 2017370
description:
2025-11-17 16:31:36 dovecot_login authenticator failed for (pool-109-191-146-98.is74.ru) [109.191.146.98]:49828: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 154.213.164.69
country_id: 2921044
description:
[2025-11-17 16:31:13 -0300] info [webmaild] 154.213.164.69 - andre.nascimento@calcautomacao.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2025-11-17 16:31:16 dovecot_login authenticator failed for ([196.188.187.21]) [196.188.187.21]:43666: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.30.14.221
country_id: 6252001
description:
2025-11-17 16:32:45 dovecot_login authenticator failed for pool-108-30-14-221.nycmny.fios.verizon.net [108.30.14.221]:35350: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2025-11-17 16:32:52 dovecot_login authenticator failed for ([180.71.9.31]) [180.71.9.31]:40468: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 16:32:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<g4YJas9DqJNo7MS0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<pZVras9DUIWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 16:32:15 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:50761: 535 Incorrect authentication data (set_id=root@jacgeneralcleaning.com)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DXubaM9DjOaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.228.146
country_id: 1269750
description:
2025-11-17 16:32:33 dovecot_login authenticator failed for ([125.16.32.137]) [125.20.228.146]:60876: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.74.9.190
country_id: 1814991
description:
2025-11-17 16:32:37 dovecot_login authenticator failed for ([101.230.0.49]) [124.74.9.190]:49189: 535 Incorrect authentication data (set_id=atendimento@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.110.53.177
country_id: 1668284
description:
2025-11-17 16:32:43 dovecot_login authenticator failed for mail.dichieweb.com [123.110.53.177]:45344: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 111.61.177.187
country_id: 1814991
description:
Nov 17 16:33:11 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@maringaparts.com.br>, method=PLAIN, rip=111.61.177.187, lip=200.150.196.245, TLS, session=<SiROac9DiGpvPbG7>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fuAqbM9DTJuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.233.210.188
country_id: 6252001
description:
2025-11-17 16:33:49 dovecot_login authenticator failed for d-24-233-210-188.md.cpe.atlanticbb.net [24.233.210.188]:41576: 535 Incorrect authentication data (set_id=junior.gomes@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.87
country_id: 3625428
description:
2025-11-17 16:33:50 dovecot_login authenticator failed for ([190.114.243.80]) [190.114.243.87]:41523: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 16:33:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<4Ww8bc9D5OGl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.203.37.225
country_id: 6252001
description:
2025-11-17 16:33:06 dovecot_login authenticator failed for 104-203-37-225.static4.bluestreamfiber.net [104.203.37.225]:33429: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.62.85
country_id: 1814991
description:
2025-11-17 16:33:16 dovecot_login authenticator failed for ([36.135.62.84]) [36.135.62.85]:54160: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.172
country_id: 1819730
description:
2025-11-17 16:33:24 dovecot_login authenticator failed for 172.43.246.220.static.netvigator.com [220.246.43.172]:62747: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-17 16:34:02 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:34406: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
country_id: 1819730
description:
2025-11-17 16:34:08 dovecot_login authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:62114: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-11-17 16:34:13 dovecot_login authenticator failed for (c-50-188-204-213.unallocated.comcastbusiness.net) [50.188.204.213]:35272: 535 Incorrect authentication data (set_id=junior.gomes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.61.244
country_id: 1814991
description:
2025-11-17 16:34:15 dovecot_login authenticator failed for ([111.26.61.244]) [111.26.61.244]:59704: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<oPm7b89DTraxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
country_id: 2017370
description:
2025-11-17 16:35:11 dovecot_login authenticator failed for ([178.178.222.56]) [178.178.222.56]:46452: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.31.17.131
country_id: 3175395
description:
2025-11-17 16:35:17 dovecot_login authenticator failed for ([87.31.17.131]) [87.31.17.131]:57804: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.247.58
country_id: 3469034
description:
2025-11-17 16:35:21 dovecot_login authenticator failed for ([186.238.157.140]) [187.9.247.58]:56968: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<aZpUc89DxNyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.99.148.146
country_id: 6252001
description:
2025-11-17 16:35:38 dovecot_login authenticator failed for (ool-4b639492.static.optonline.net) [75.99.148.146]:45327: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.212.198.226
country_id: 1814991
description:
2025-11-17 16:35:47 dovecot_login authenticator failed for ([27.212.198.226]) [27.212.198.226]:47486: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.117
country_id: 1814991
description:
2025-11-17 16:36:01 dovecot_login authenticator failed for ([111.26.106.117]) [111.26.106.117]:53712: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2025-11-17 16:36:01 dovecot_login authenticator failed for (122.55.57.177.pldt.net) [210.1.66.154]:52165: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Xp4hdc9DZIGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-11-17 16:36:04 dovecot_login authenticator failed for ([200.149.213.242]) [200.149.213.242]:39867: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 16:36:12 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<XeOXdc9DID1o7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-11-17 16:36:22 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:54518: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<THTjds9DqpCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.204.32
country_id: 1814991
description:
2025-11-17 16:36:40 dovecot_login authenticator failed for ([220.180.204.32]) [220.180.204.32]:42950: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 16:36:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<vHhUds9D5rSd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-11-17 16:36:40 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:38802: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.60
country_id: 798544
description:
2025-11-17 16:36:42 dovecot_login authenticator failed for (60.84.41.31.ip4.feromedia.eu) [31.41.84.60]:52106: 535 Incorrect authentication data (set_id=faturamento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-11-17 16:36:58 dovecot_login authenticator failed for ([74.208.177.56]) [74.208.177.56]:33302: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.143
country_id: 1668284
description:
2025-11-17 16:38:04 dovecot_login authenticator failed for 110-25-112-143.adsl.fetnet.net [110.25.112.143]:36875: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.156.121
country_id: 1814991
description:
2025-11-17 16:37:16 dovecot_login authenticator failed for (121.156.170.222.broad.sh.hl.dynamic.163data.com.cn) [222.170.156.121]:51396: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 16:37:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<Ois5es9DtLSl0xnK>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qTJ9es9DhrOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.80.158
country_id: 1269750
description:
2025-11-17 16:37:39 dovecot_login authenticator failed for (victoryent.in) [111.93.80.158]:35608: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.39.106
country_id: 1814991
description:
2025-11-17 16:38:45 dovecot_login authenticator failed for ([219.139.39.106]) [219.139.39.106]:33284: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-17 16:38:59 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:34902: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<MY7ef89D0O2xV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<wtkOfs9DENqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-17 16:38:57 dovecot_login authenticator failed for ([191.217.23.65]) [187.6.121.246]:42388: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 17 16:38:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@huboperacoes.com>, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=<YD8ff89DTMBnOJRs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.4
country_id: 298795
description:
2025-11-17 16:39:39 dovecot_login authenticator failed for (ADMIN) [194.116.236.4]:54920: 535 Incorrect authentication data (set_id=wilson@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.120.98
country_id: 1269750
description:
2025-11-17 16:39:42 dovecot_login authenticator failed for ([59.145.74.209]) [122.184.120.98]:57528: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.212.101
country_id: 2017370
description:
2025-11-17 16:39:52 dovecot_login authenticator failed for (net212.234.188-101.ertelecom.ru) [188.234.212.101]:54954: 535 Incorrect authentication data (set_id=bianca.user.hr@globalmedica.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Lomjgc9D6ouxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.241
country_id: 1668284
description:
2025-11-17 16:39:22 dovecot_login authenticator failed for 111-70-23-241.emome-ip.hinet.net [111.70.23.241]:50359: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.193.149.88
country_id: 6252001
description:
2025-11-17 16:39:28 dovecot_login authenticator failed for ool-44c19558.dyn.optonline.net [68.193.149.88]:32797: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 17 16:39:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<7I9ogc9D7s47GIXF>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.103.200
country_id: 1668284
description:
2025-11-17 16:39:36 dovecot_login authenticator failed for 110-25-103-200.adsl.fetnet.net [110.25.103.200]:38670: 535 Incorrect authentication data (set_id=brizola)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.189.109.187
country_id: 2017370
description:
2025-11-17 16:39:54 dovecot_login authenticator failed for ([95.189.109.187]) [95.189.109.187]:40748: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.248.170
country_id: 1269750
description:
2025-11-17 16:39:14 dovecot_login authenticator failed for ([125.23.229.142]) [125.19.248.170]:53730: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.121.246
country_id: 3469034
description:
2025-11-17 16:40:07 dovecot_login authenticator failed for ([191.217.23.65]) [187.6.121.246]:38446: 535 Incorrect authentication data (set_id=novalondria@cieadep.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-17 16:40:37 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:36881: 535 Incorrect authentication data (set_id=paulo.user.hr@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.134
country_id: 2017370
description:
2025-11-17 16:40:46 dovecot_login authenticator failed for ([178.178.194.134]) [178.178.194.134]:58360: 535 Incorrect authentication data (set_id=comercial@huboperacoes.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-17 16:41:03 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:44214: 535 Incorrect authentication data (set_id=paulo.user.hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.114
country_id: 1269750
description:
2025-11-17 16:40:59 dovecot_login authenticator failed for ([182.95.193.177]) [182.95.223.114]:35118: 535 Incorrect authentication data (set_id=comercial)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.208.169
country_id: 2661886
description:
2025-11-17 16:40:08 dovecot_login authenticator failed for 94-255-208-169.cust.bredband2.com [94.255.208.169]:42942: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 168.232.81.177
country_id: 3469034
description:
2025-11-17 16:40:16 H=(localhost) [168.232.81.177]:27111 F=<hello@localhost> rejected RCPT <ffouOMj4dIxnpfT@1075fm.com.br>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.58.156.82
country_id: 1668284
description:
2025-11-17 16:40:31 dovecot_login authenticator failed for (82-156-58-61.tinp.net.tw) [61.58.156.82]:53089: 535 Incorrect authentication data (set_id=novalondria)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fQA2hc9D/qqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.230.82.157
country_id: 2658434
description:
2025-11-17 16:40:39 dovecot_login authenticator failed for ([194.230.82.157]) [194.230.82.157]:46326: 535 Incorrect authentication data (set_id=bianca.user.hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.63.175
country_id: 1814991
description:
2025-11-17 16:40:45 dovecot_login authenticator failed for ([182.135.63.175]) [182.135.63.175]:51794: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2025-11-17 16:41:14 dovecot_login authenticator failed for ([65.20.202.4]) [65.20.202.4]:56469: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-17 16:41:30 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:62028: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<z1/KiM9DhsWxV3kv>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.82.65.48
country_id: 2077456
description:
[2025-11-17 16:41:32 -0300] info [cpaneld] 103.82.65.48 - sindeesf "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user sindeesf (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.219.232.34
country_id: 1835841
description:
2025-11-17 16:41:45 dovecot_login authenticator failed for ([210.219.232.34]) [210.219.232.34]:35708: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.14
country_id: 1814991
description:
2025-11-17 16:41:59 dovecot_login authenticator failed for ([125.90.72.14]) [125.90.72.14]:41798: 535 Incorrect authentication data (set_id=flavio.oliveira@8it.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yIaYis9D8tSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.128.93.57
country_id: 2635167
description:
2025-11-17 16:42:08 dovecot_login authenticator failed for host86-128-93-57.range86-128.btcentralplus.com [86.128.93.57]:45682: 535 Incorrect authentication data (set_id=flavio.oliveira)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.140.54
country_id: 1269750
description:
2025-11-17 16:42:41 dovecot_login authenticator failed for ([125.21.194.121]) [125.23.140.54]:41688: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.244.6.94
country_id: 2017370
description:
2025-11-17 16:42:40 dovecot_login authenticator failed for (ws6-94.maryno.net) [188.244.6.94]:55084: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 16:42:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<aNUjjc9DfpBA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 16:43:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<kcwWjs9DlOnSchJs>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<7DBhjM9D7OGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 16:42:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<rjsqjc9D6rskMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.202
country_id: 1269750
description:
2025-11-17 16:42:53 dovecot_login authenticator failed for ([152.52.244.202]) [152.52.244.202]:49268: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.0.140
country_id: 2017370
description:
2025-11-17 16:43:00 dovecot_login authenticator failed for ([31.173.0.140]) [31.173.0.140]:44976: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 16:44:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<a8qakc9DfIVns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 16:43:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<5tFpj89Drq2Gx8nN>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<2af3j89D0JKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 17 16:43:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<KMZvkc9DAiOnYwhf>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 178.216.25.24
country_id: 798544
description:
Nov 17 16:44:01 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos@maringasoldas.com.br>, method=PLAIN, rip=178.216.25.24, lip=200.150.196.245, TLS, session=<41aRkM9DjJOy2BkY>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.122.185
country_id: 6252001
description:
2025-11-17 16:44:55 dovecot_login authenticator failed for 71-208-122-185.ftmy.qwest.net [71.208.122.185]:58591: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 17 16:44:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<FPwBlc9DcC2317Oa>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 16:44:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadorajl.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<rop2ks9DtK8IjQ01>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<iqOLk89DLrqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-17 16:44:34 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:34882: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2025-11-17 16:44:37 dovecot_login authenticator failed for ([50.187.155.130]) [50.187.155.130]:43628: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.67.36
country_id: 1814991
description:
2025-11-17 16:44:26 dovecot_login authenticator failed for ([111.26.67.36]) [111.26.67.36]:47786: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AUdMlc9D0saxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 16:45:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<8FiClc9DnsCd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-11-17 16:45:09 dovecot_login authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:40096: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HNwbl89DANmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.215
country_id: 3865483
description:
2025-11-17 16:45:34 dovecot_login authenticator failed for (201-234-106-215.static.impsat.net.ar) [201.234.106.215]:43057: 535 Incorrect authentication data (set_id=gerson@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.94
country_id: 6252001
description:
2025-11-17 16:45:47 dovecot_login authenticator failed for (ftth-139-60-85-94.hamiltoncom.net) [139.60.85.94]:59176: 535 Incorrect authentication data (set_id=gerson)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.0.185
country_id: 2017370
description:
2025-11-17 16:46:04 dovecot_login authenticator failed for ([46.44.0.185]) [46.44.0.185]:55678: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
country_id: 99237
description:
2025-11-17 16:46:42 dovecot_login authenticator failed for ([65.20.250.63]) [65.20.250.63]:37148: 535 Incorrect authentication data (set_id=comercial.user.hr@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.191.146.98
country_id: 2017370
description:
2025-11-17 16:47:01 dovecot_login authenticator failed for (pool-109-191-146-98.is74.ru) [109.191.146.98]:58060: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2025-11-17 16:46:16 dovecot_login authenticator failed for ns3241969.ip-57-129-90.eu [57.129.90.215]:33314: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.135.46.226
country_id: 1819730
description:
2025-11-17 16:46:18 dovecot_plain authenticator failed for (xuof7t6ywo1p3gtl4lk07egwrobke) [43.135.46.226]:37074: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<NmSrms9DUIqxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<XuA+ns9D8K6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 16:47:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<eTMon89Dxo9n9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<iXgEoM9DJLqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-17 16:47:12 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:33097: 535 Incorrect authentication data (set_id=comercial.user.hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.142
country_id: 1269750
description:
2025-11-17 16:47:18 dovecot_login authenticator failed for ([128.185.227.142]) [128.185.227.142]:49076: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.1.60.243
country_id: 1605651
description:
Nov 17 16:47:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=<DRo+nc9D6uDSATzz>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 16:47:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<Axtwnc9DhMrSchJs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 16:48:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@implementarconsultoria.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<WiEooM9D9sgIjQ01>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 16:48:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<RCtkoM9D7q1SnOdL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<oNbZoc9Dds6xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 16:48:41 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:52624: 535 Incorrect authentication data (set_id=root@interlubfiltros.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 16:49:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<bhLops9DsKdns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<a2Zlpc9DWOaxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<qiXEqs9DtLixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2025-11-17 16:50:10 dovecot_login authenticator failed for ([49.206.201.253]) [49.206.201.253]:52584: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.72.74.130
country_id: 2017370
description:
2025-11-17 16:50:29 dovecot_login authenticator failed for ([188.72.74.130]) [188.72.74.130]:57510: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<l5z0qM9D/KixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.122.211.212
country_id: 1814991
description:
2025-11-17 16:51:46 dovecot_login authenticator failed for (calcautomacao.com.br) [111.122.211.212]:14872: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2025-11-17 16:51:59 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:60160: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.189.100
country_id: 1269750
description:
2025-11-17 16:51:26 dovecot_login authenticator failed for ([122.175.189.100]) [122.175.189.100]:48455: 535 Incorrect authentication data (set_id=paulinho.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.169.37.163
country_id: 2077456
description:
2025-11-17 16:51:29 dovecot_login authenticator failed for (cpe-58-169-37-163.wb02.wa.asp.telstra.net) [58.169.37.163]:59408: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<U+KPrM9DzMixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
country_id: 1819730
description:
2025-11-17 16:51:41 dovecot_login authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:63473: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.170.1.244
country_id: 3017382
description:
2025-11-17 16:51:44 dovecot_login authenticator failed for 176-170-1-244.abo.bbox.fr [176.170.1.244]:33263: 535 Incorrect authentication data (set_id=paulinho.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.167.85
country_id: 6252001
description:
2025-11-17 16:51:44 dovecot_login authenticator failed for 24.115.167.85.res-cmts.mlf.ptd.net [24.115.167.85]:47895: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 17 16:52:42 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<HoqcsM9DklanYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.237.108
country_id: 1814991
description:
2025-11-17 16:52:45 dovecot_login authenticator failed for ([218.22.237.108]) [218.22.237.108]:34690: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.82.40.34
country_id: 1694008
description:
2025-11-17 16:52:49 dovecot_login authenticator failed for ([203.82.40.34]) [203.82.40.34]:56398: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.53.245.92
country_id: 2017370
description:
2025-11-17 16:53:02 dovecot_login authenticator failed for ([95.53.245.92]) [95.53.245.92]:42951: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.122.211.212
country_id: 1814991
description:
2025-11-17 16:52:10 dovecot_login authenticator failed for (calcautomacao.com.br) [111.122.211.212]:19866: 535 Incorrect authentication data (set_id=admin@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.29.233
country_id: 3469034
description:
2025-11-17 16:52:32 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [179.185.29.233]:56958: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lycksM9DUOexV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xh23s89DFKGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.12.106.119
country_id: 1814991
description:
2025-11-17 16:53:42 dovecot_login authenticator failed for ([60.12.106.119]) [60.12.106.119]:34514: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5dB5tc9DArexV3kv>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 177.16.29.122
country_id: 3469034
description:
[2025-11-17 16:53:08 -0300] info [webmaild] 177.16.29.122 - palozi@arkson.com.br "GET /cpsess6933818839/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 16:53:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<biA5s89DTJKl0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 16:53:27 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<K0dGs89D0N5ns7yS>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 16:53:29 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<cqVfs89DtOSvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
country_id: 6251999
description:
2025-11-17 16:54:41 dovecot_login authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:52726: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.67.122.230
country_id: 1835841
description:
2025-11-17 16:54:43 dovecot_login authenticator failed for ([220.67.122.230]) [220.67.122.230]:33866: 535 Incorrect authentication data (set_id=rebecakessler@prafebrum.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 16:54:57 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<OtaZuM9DZLkXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.251.66
country_id: 1269750
description:
2025-11-17 16:55:00 dovecot_login authenticator failed for (nsg-corporate-121.161.185.122.airtel.in) [125.20.251.66]:49958: 535 Incorrect authentication data (set_id=vendas.luiz@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<oIZNt89DkMSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2025-11-17 16:55:50 dovecot_login authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:55192: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2025-11-17 16:56:03 dovecot_login authenticator failed for ([182.95.25.99]) [182.95.60.146]:48322: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.41.156.64
country_id: 2017370
description:
2025-11-17 16:55:20 dovecot_login authenticator failed for ([77.41.156.64]) [77.41.156.64]:53722: 535 Incorrect authentication data (set_id=vendas.luiz)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 17 16:55:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<+Un2us9DXs0zTY0d>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-17 16:55:45 H=(195.3.134.135) [179.0.178.53]:64425 F=<erictremblaysi@hotmail.com> rejected RCPT <almox@transol.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:64425 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 16:55:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<mtC+us9DAs5n9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.194.166
country_id: 1269750
description:
2025-11-17 16:55:08 dovecot_login authenticator failed for ([125.19.175.13]) [125.19.194.166]:35290: 535 Incorrect authentication data (set_id=rebecakessler)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.176.229.36
country_id: 2017370
description:
2025-11-17 16:55:25 dovecot_login authenticator failed for ([178.176.229.36]) [178.176.229.36]:35510: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:55:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<HTjXus9D7OaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2025-11-17 16:56:05 dovecot_login authenticator failed for ([61.37.150.35]) [61.37.150.6]:17066: 535 Incorrect authentication data (set_id=vanessalima)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5O1tvs9DuJWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 16:56:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<j4Sqvs9DLr9A44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 16:56:37 dovecot_login authenticator failed for (User) [177.74.174.120]:55934: 535 Incorrect authentication data (set_id=silva@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.186
country_id: 1269750
description:
2025-11-17 16:56:42 dovecot_login authenticator failed for ([125.23.235.41]) [182.95.49.186]:60072: 535 Incorrect authentication data (set_id=doninha@ilumix.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<AP89wM9D6qyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 16:57:10 dovecot_login authenticator failed for (User) [177.74.174.120]:55934: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.226.118.0
country_id: 3469034
description:
2025-11-17 16:57:13 dovecot_login authenticator failed for ([38.226.118.9]) [38.226.118.0]:46884: 535 Incorrect authentication data (set_id=doninha)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.169.206.79
country_id: 3469034
description:
2025-11-17 16:57:22 H=(localhost) [45.169.206.79]:43632 F=<hello@localhost> rejected RCPT <pmgvwjROhKXIZDN@adlondrina.com.br>: Sender verify failed


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lrX9wc9DwLqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.64.64.8
country_id: 2264397
description:
2025-11-17 16:57:38 dovecot_login authenticator failed for bl23-64-8.dsl.telepac.pt [144.64.64.8]:4857: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 168.197.87.49
country_id: 3469034
description:
2025-11-17 16:57:50 H=(localhost) [168.197.87.49]:44210 F=<hello@localhost> rejected RCPT <fm6HP7n11NgbeuP@adpiraquara.com.br>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.22.27.146
country_id: 2300660
description:
2025-11-17 16:57:51 dovecot_login authenticator failed for ([102.22.27.146]) [102.22.27.146]:49956: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<bVqVxc9DCNuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2025-11-17 16:58:35 dovecot_login authenticator failed for (70-91-135-181-ma-ne.hfc.comcastbusiness.net) [70.91.135.181]:52084: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.219.150
country_id: 1269750
description:
2025-11-17 16:58:50 dovecot_login authenticator failed for (nsg-corporate-150.219.186.122.airtel.in) [122.186.219.150]:43340: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 17 16:58:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<VRn6xs9DWJSdQi/y>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 168.197.87.49
country_id: 3469034
description:
2025-11-17 16:58:07 H=(localhost) [168.197.87.49]:44210 F=<hello@localhost> rejected RCPT <contato@adpiraquara.com.br>: Sender verify failed


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 17 16:58:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@joelbuenoadvogados.com.br>, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=<FYw3xM9D7JFnOJRs>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 16:58:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ufadville.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<Dj/VxM9DXpIIjQ01>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 16:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<F30oyc9DsIqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
country_id: 1668284
description:
2025-11-17 16:59:38 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:40274: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.51.205.170
country_id: 6252001
description:
2025-11-17 16:59:52 dovecot_login authenticator failed for pool-108-51-205-170.washdc.fios.verizon.net [108.51.205.170]:59152: 535 Incorrect authentication data (set_id=info.user.hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
country_id: 1835841
description:
2025-11-17 16:59:14 dovecot_login authenticator failed for ([1.244.246.221]) [1.244.246.221]:39150: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.101.241.44
country_id: 1835841
description:
2025-11-17 16:59:20 dovecot_login authenticator failed for ([222.101.241.44]) [222.101.241.44]:60085: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.200.180.174
country_id: 6252001
description:
2025-11-17 16:59:38 dovecot_login authenticator failed for survey.hagbergconsulting.com [207.200.180.174]:59107: 535 Incorrect authentication data (set_id=info.user.hr@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.138.130.143
country_id: 2017370
description:
2025-11-17 16:59:49 dovecot_login authenticator failed for (143.130.138.78.in-addr.arpa) [78.138.130.143]:58774: 535 Incorrect authentication data (set_id=andre.nascimento.hr@calcautomacao.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<lO36ys9DdpixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2025-11-17 17:00:49 dovecot_login authenticator failed for ([65.20.149.26]) [65.20.149.26]:43932: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
country_id: 1880251
description:
2025-11-17 17:00:25 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:36700: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:00:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WNzAzM9DTKyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.186.93
country_id: 1562822
description:
2025-11-17 17:00:35 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.186.93]:50435: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.17.96
country_id: 2077456
description:
2025-11-17 17:00:47 dovecot_login authenticator failed for ([120.157.17.96]) [120.157.17.96]:47180: 535 Incorrect authentication data (set_id=rodrigo@contagui.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.91.92.251
country_id: 1814991
description:
2025-11-17 17:00:40 dovecot_login authenticator failed for ([39.82.19.35]) [39.91.92.251]:45880: 535 Incorrect authentication data (set_id=wesley)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.0.216
country_id: 1835841
description:
2025-11-17 17:00:09 dovecot_login authenticator failed for ([118.60.136.49]) [183.107.0.216]:58462: 535 Incorrect authentication data (set_id=andre.nascimento.hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-11-17 17:00:20 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:45186: 535 Incorrect authentication data (set_id=wesley@toromartelinho.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 17:00:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<Pg2TzM9DBMAkMrBu>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 17:00:38 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<6+DnzM9DOtVn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.51.142.242
country_id: 1814991
description:
2025-11-17 17:01:05 dovecot_login authenticator failed for ([222.85.202.86]) [59.51.142.242]:46827: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5GVW0M9DQsWxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.4
country_id: 6252001
description:
Nov 17 17:01:56 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=194.164.107.4, lip=186.233.225.118, TLS, session=<vae50c9D2JXCpGsE>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<de2s1c9DWIOxV3kv>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:02:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<cebo089DgOSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 17:02:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<UeUm1M9D/IxxoZB3>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 17:02:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<X7dk1M9DwoCl0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 17:03:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<o+tI189DqrlSnOdL>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<RgR8189DZJSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 17:03:36 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:56185: 535 Incorrect authentication data (set_id=test@implementarconsultoria.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.179.189.189
country_id: 3469034
description:
Nov 17 17:03:46 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<jesse>, method=PLAIN, rip=45.179.189.189, lip=200.150.196.245, TLS, session=<j1o3189DIqIts729>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.229.128.251
country_id: 2017370
description:
2025-11-17 17:03:53 dovecot_login authenticator failed for ([46.229.128.251]) [46.229.128.251]:39212: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2025-11-17 17:03:54 dovecot_login authenticator failed for ([65.20.211.96]) [65.20.211.96]:36473: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
country_id: 6252001
description:
2025-11-17 17:03:16 dovecot_login authenticator failed for (70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [70.89.116.5]:35428: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.168.17.20
country_id: 2077456
description:
2025-11-17 17:04:10 dovecot_login authenticator failed for ([101.168.17.20]) [101.168.17.20]:39276: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.122.103.21
country_id: 1835841
description:
2025-11-17 17:04:12 dovecot_login authenticator failed for ([222.122.103.21]) [222.122.103.21]:34215: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.126.105.42
country_id: 3469034
description:
2025-11-17 17:04:29 dovecot_login authenticator failed for 187-126-105-42.user.vtal.net.br [187.126.105.42]:53119: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<aIQM289DZrWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 45.163.198.144
country_id: 3469034
description:
Nov 17 17:04:33 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<novidadevida>, method=PLAIN, rip=45.163.198.144, lip=200.150.196.245, TLS, session=<GmIO2s9D9pgto8aQ>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 17:05:19 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<Qp6+3c9DKqlxoZB3>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<GOOZ3s9DUM2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2025-11-17 17:05:39 dovecot_login authenticator failed for ([196.28.226.124]) [196.28.226.124]:41723: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.103.196.124
country_id: 3469034
description:
2025-11-17 17:05:49 dovecot_login authenticator failed for 187-103-196-124.comfibranet.com.br [187.103.196.124]:58240: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<shFq4M9DquGxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<hA454s9DgO2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 17:06:08 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<mhif4M9D4rmGx8nN>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 17:06:20 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<Usxj4c9Dap9A44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:07:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EODG5c9DNJ2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 17:07:35 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<8ELK5c9DKoFns7yS>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:09:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<PZgq689D0sixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 17:08:23 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<q2ev6M9Durx9gnHM>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:08:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<KYhT6c9DqLaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 17:08:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<7Zv16c9DvJ0naoFh>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.110.11
country_id: 2661886
description:
2025-11-17 17:09:15 dovecot_login authenticator failed for h77-53-110-11.cust.bredband2.com [77.53.110.11]:39788: 535 Incorrect authentication data (set_id=desenvolvimento2@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 17:09:22 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<EbMq7M9DtiqvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 17:09:22 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:59116: 535 Incorrect authentication data (set_id=info@jacgeneralcleaning.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:09:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<GQTt7M9DbtWxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 17 17:09:39 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@missgospel.com>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<emws7c9DWNM+PIOJ>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2025-11-17 17:09:44 dovecot_login authenticator failed for ([193.46.192.20]) [193.46.192.20]:33212: 535 Incorrect authentication data (set_id=desenvolvimento2)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 61.73.190.98
country_id: 1835841
description:
Nov 17 17:10:59 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback>, method=PLAIN, rip=61.73.190.98, lip=200.150.196.245, TLS, session=<vaqd789DzaI9Sb5i>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2025-11-17 17:11:00 dovecot_login authenticator failed for ([208.69.161.214]) [208.69.161.214]:50195: 535 Incorrect authentication data (set_id=aureovieira)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:10:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<I2988M9DDIixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.80.228.231
country_id: 6252001
description:
2025-11-17 17:10:34 dovecot_login authenticator failed for ([129.80.228.231]) [129.80.228.231]:33182: 535 Incorrect authentication data (set_id=aureovieira@ieq.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.153.96
country_id: 1814991
description:
2025-11-17 17:10:46 dovecot_login authenticator failed for ([222.71.159.58]) [222.68.153.96]:39345: 535 Incorrect authentication data (set_id=brizola@89fmjoinville.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.194.166
country_id: 1269750
description:
2025-11-17 17:10:58 dovecot_login authenticator failed for ([125.19.175.13]) [125.19.194.166]:45260: 535 Incorrect authentication data (set_id=brizola)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 93.91.153.26
country_id: 3077311
description:
Nov 17 17:10:10 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<feedback@8it.com.br>, method=PLAIN, rip=93.91.153.26, lip=200.150.196.245, TLS, session=<yDX/7c9DPLVdW5ka>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.101.122
country_id: 1814991
description:
2025-11-17 17:10:39 dovecot_login authenticator failed for ([111.26.101.122]) [111.26.101.122]:59856: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 17:10:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<FEt48c9DQoknaoFh>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 17:11:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<uLYG889DvD5o7MS0>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:11:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IdUQ9M9DtKWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.205.20.70
country_id: 6251999
description:
2025-11-17 17:11:39 dovecot_login authenticator failed for (ADMIN) [4.205.20.70]:62914: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
country_id: 1814991
description:
2025-11-17 17:11:54 dovecot_login authenticator failed for ([60.172.1.210]) [60.172.1.210]:42006: 535 Incorrect authentication data (set_id=bqtz@iemif.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:12:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<T4TY9c9D6LKxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:12:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<x02p989D2sCxV3kv>


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 188.44.20.25
country_id: 718075
description:
Nov 17 17:12:37 hosting pure-ftpd: (?@188.44.20.25) [WARNING] Authentication failed for user [ilumix]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-11-17 17:12:10 dovecot_login authenticator failed for ([196.191.212.235]) [213.55.85.202]:3680: 535 Incorrect authentication data (set_id=bqtz)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.247.43.42
country_id: 2017370
description:
2025-11-17 17:12:21 dovecot_login authenticator failed for ([188.247.43.42]) [188.247.43.42]:54660: 535 Incorrect authentication data (set_id=rodrigo)


plugin: ossec
rule: 11321
name: Active Response. FTP brute force attack (Port 21 is protected)
abuser: 188.44.20.25
country_id: 718075
description:
Nov 17 17:13:01 hosting pure-ftpd: (?@188.44.20.25) [WARNING] Authentication failed for user [ilumix]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.98.80
country_id: 453733
description:
2025-11-17 17:12:08 dovecot_login authenticator failed for 80-98-157-37.dyn.estpak.ee [37.157.98.80]:50872: 535 Incorrect authentication data (set_id=rodrigo@89fmjoinville.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 17:13:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<ASdX/M9DAJl9gnHM>


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 188.44.20.25
country_id: 718075
description:
Nov 17 17:13:07 hosting pure-ftpd: (?@188.44.20.25) [WARNING] Authentication failed for user [ilumix]


plugin: ossec
rule: 11331
name: Stealth FTP brute force attack
abuser: 188.44.20.25
country_id: 718075
description:
Nov 17 17:13:16 hosting pure-ftpd: (?@188.44.20.25) [WARNING] Authentication failed for user [ilumix]


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:13:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<03pD+89DmuGxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 17:13:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<GJAZ/M9D2M+d5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.157.129.153
country_id: 1835841
description:
2025-11-17 17:14:11 dovecot_login authenticator failed for ([218.157.129.153]) [218.157.129.153]:34039: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:14:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<DHrL/s9DNpixV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 17:14:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<hq/O/s9DEhJo7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.152.61
country_id: 6252001
description:
2025-11-17 17:14:45 dovecot_login authenticator failed for (c-50-187-152-61.unallocated.comcastbusiness.net) [50.187.152.61]:59068: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.75.191.183
country_id: 1733045
description:
2025-11-17 17:14:49 H=([103.75.191.183]) [103.75.191.183]:57112 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=<silva.tiago@protagnstvendas.com> rejected RCPT <ivan.panicio@8it.com.br>: "JunkMail rejected - ([103.75.191.183]) [103.75.191.183]:57112 is in an RBL: Listed by XBL, see https://check.spamhaus.org/query/ip/103.75.191.183"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-11-17 17:15:01 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:40706: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:15:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<toycANBD6qWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.49.34
country_id: 3469034
description:
2025-11-17 17:16:04 dovecot_login authenticator failed for (179-42-49-47.fastinternet.inf.br) [179.42.49.34]:57448: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.247.189.189
country_id: 6252001
description:
2025-11-17 17:15:13 dovecot_login authenticator failed for ([50.247.189.189]) [50.247.189.189]:40893: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.48.40.6
country_id: 1814991
description:
2025-11-17 17:15:17 dovecot_login authenticator failed for (6.40.48.59.broad.cz.sx.dynamic.163data.com.cn) [59.48.40.6]:47434: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.165
country_id: 3686110
description:
2025-11-17 17:15:31 dovecot_login authenticator failed for ([186.97.203.165]) [186.97.203.165]:38300: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:15:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<i0VcAtBDTruxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.246.178
country_id: 1269750
description:
2025-11-17 17:15:54 dovecot_login authenticator failed for ([152.52.246.178]) [152.52.246.178]:35334: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.119.132.230
country_id: 2510769
description:
2025-11-17 17:16:21 dovecot_login authenticator failed for ([176.119.132.230]) [176.119.132.230]:40280: 535 Incorrect authentication data (set_id=faturamento@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.194.26.149
country_id: 1168579
description:
2025-11-17 17:16:36 dovecot_login authenticator failed for ([45.194.26.149]) [45.194.26.149]:46632: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.196.185
country_id: 2017370
description:
2025-11-17 17:16:44 dovecot_login authenticator failed for ([5.142.196.185]) [5.142.196.185]:38843: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.124.225.159
country_id: 2017370
description:
2025-11-17 17:16:46 dovecot_login authenticator failed for (host-94.124.225.159.gascom.net.ru) [94.124.225.159]:49298: 535 Incorrect authentication data (set_id=faturamento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.226.196
country_id: 1814991
description:
2025-11-17 17:16:51 dovecot_login authenticator failed for ([221.10.226.196]) [221.10.226.196]:36050: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.195
country_id: 192950
description:
2025-11-17 17:16:54 dovecot_login authenticator failed for ([102.215.188.195]) [102.215.188.195]:44187: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.109.154.54
country_id: 3469034
description:
2025-11-17 17:16:10 dovecot_login authenticator failed for ([189.109.154.54]) [189.109.154.54]:34908: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:16:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QeXzBdBDpNWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2025-11-17 17:16:35 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [116.98.104.138]:53514: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.39.27.8
country_id: 1835841
description:
2025-11-17 17:16:46 dovecot_login authenticator failed for ([118.39.27.8]) [118.39.27.8]:34516: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.114
country_id: 1269750
description:
2025-11-17 17:16:59 dovecot_login authenticator failed for ([122.184.89.169]) [125.23.203.114]:60226: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.229.128.251
country_id: 2017370
description:
2025-11-17 17:17:13 dovecot_login authenticator failed for ([46.229.128.251]) [46.229.128.251]:47668: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.2.86
country_id: 3469034
description:
2025-11-17 17:17:53 dovecot_login authenticator failed for (187-93-2-86.customer.tdatabrasil.net.br) [187.93.2.86]:39780: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
country_id: 1814991
description:
2025-11-17 17:17:59 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:40060: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.166.87.145
country_id: 1814991
description:
2025-11-17 17:18:03 dovecot_login authenticator failed for ([223.166.87.145]) [223.166.87.145]:57594: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:17:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<mgyLCdBDKo2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.233.210.188
country_id: 6252001
description:
2025-11-17 17:17:43 dovecot_login authenticator failed for d-24-233-210-188.md.cpe.atlanticbb.net [24.233.210.188]:45558: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
country_id: 1861060
description:
2025-11-17 17:17:57 dovecot_login authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:56120: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:18:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ydRWC9BDhpuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.27.253.6
country_id: 1168579
description:
2025-11-17 17:18:06 dovecot_login authenticator failed for (58-27-253-6.wateen.net) [58.27.253.6]:57258: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 17 17:18:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@huboperacoes.com>, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=<bwTxC9BDTJNnOJRs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.68
country_id: 3996063
description:
2025-11-17 17:18:19 dovecot_login authenticator failed for ([201.173.216.68]) [201.173.216.68]:42547: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 17:18:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<xg7XDNBD1Nel0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-11-17 17:18:36 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:43400: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 17:18:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@highqualityautoparts.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<gHQjDNBDfMU+PIOL>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 138.94.168.28
country_id: 3469034
description:
[2025-11-17 17:18:34 -0300] info [webmaild] 138.94.168.28 - hcpessoal@hipercesta.com.br "GET /cpsess5611635049/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.229.254.207
country_id: 2017370
description:
2025-11-17 17:18:18 dovecot_login authenticator failed for ([87.229.254.207]) [87.229.254.207]:49076: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.79.255.104
country_id: 2017370
description:
2025-11-17 17:18:36 dovecot_login authenticator failed for ([37.79.255.104]) [37.79.255.104]:35457: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2025-11-17 17:18:09 dovecot_login authenticator failed for ([103.133.175.82]) [103.142.184.55]:34113: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.183
country_id: 2017370
description:
2025-11-17 17:18:26 dovecot_login authenticator failed for ([46.8.246.183]) [46.8.246.183]:37084: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:18:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<C7ciDdBDDLmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.145
country_id: 1668284
description:
2025-11-17 17:18:50 dovecot_login authenticator failed for 110-25-112-145.adsl.fetnet.net [110.25.112.145]:57087: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.201.209.152
country_id: 6252001
description:
2025-11-17 17:19:26 dovecot_login authenticator failed for mobile-166-201-209-152.mycingular.net [166.201.209.152]:60098: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:19:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<QSK0ENBD8tSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.192.57.118
country_id: 1880251
description:
2025-11-17 17:19:45 dovecot_login authenticator failed for (bb151-192-57-118.singnet.com.sg) [151.192.57.118]:51555: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.145.5.14
country_id: 1835841
description:
2025-11-17 17:19:58 dovecot_login authenticator failed for ([221.145.5.14]) [221.145.5.14]:57673: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.81.180
country_id: 2017370
description:
2025-11-17 17:20:03 dovecot_login authenticator failed for (95-165-81-180.dynamic.spd-mgts.ru) [95.165.81.180]:55566: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2025-11-17 17:20:15 dovecot_login authenticator failed for ([196.190.220.168]) [196.190.220.168]:37760: 535 Incorrect authentication data (set_id=vanessalima@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.53.199.160
country_id: 6252001
description:
2025-11-17 17:20:20 dovecot_login authenticator failed for ([136.53.199.160]) [136.53.199.160]:56390: 535 Incorrect authentication data (set_id=edna)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-11-17 17:20:29 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:62046: 535 Incorrect authentication data (set_id=vanessalima)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 17:20:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@partnerscapital.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<4CIYFNBDoIEXXz9j>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.102.11
country_id: 1814991
description:
2025-11-17 17:20:52 dovecot_login authenticator failed for ([183.6.102.11]) [183.6.102.11]:3938: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.128.123.34
country_id: 2017370
description:
2025-11-17 17:21:03 dovecot_login authenticator failed for (l5-128-123-34.novotelecom.ru) [5.128.123.34]:57895: 535 Incorrect authentication data (set_id=presidencia@sindeesfort.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.19.12.103
country_id: 2635167
description:
2025-11-17 17:20:09 dovecot_login authenticator failed for cpc122100-bmly10-2-0-cust102.2-3.cable.virginm.net [82.19.12.103]:55780: 535 Incorrect authentication data (set_id=edna@adlondrina.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:20:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0R9GFNBDIIOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2025-11-17 17:20:45 dovecot_login authenticator failed for (50-212-27-146-static.hfc.comcastbusiness.net) [50.212.27.150]:51276: 535 Incorrect authentication data (set_id=vanessalima)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:21:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<zxsJFtBDapSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2025-11-17 17:21:26 dovecot_login authenticator failed for ([211.169.212.206]) [211.169.212.206]:52421: 535 Incorrect authentication data (set_id=presidencia)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:21:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<LM7XF9BDqqSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.220
country_id: 1835841
description:
2025-11-17 17:21:37 dovecot_login authenticator failed for ([211.116.107.220]) [211.116.107.220]:39418: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-11-17 17:21:44 dovecot_login authenticator failed for ([46.30.161.197]) [46.30.161.197]:49199: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.188.18.25
country_id: 1814991
description:
2025-11-17 17:21:55 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:29260: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-11-17 17:21:07 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:42110: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.106.190
country_id: 2077456
description:
2025-11-17 17:21:24 dovecot_login authenticator failed for ([123.209.106.190]) [123.209.106.190]:40986: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 17:21:44 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<lv9jGNBDNKSl0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.200
country_id: 1269750
description:
2025-11-17 17:22:33 dovecot_login authenticator failed for ([103.146.233.200]) [103.146.233.200]:51868: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.31.17.131
country_id: 3175395
description:
2025-11-17 17:22:52 dovecot_login authenticator failed for ([87.31.17.131]) [87.31.17.131]:36306: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 17 17:22:26 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@calcautomacao.com>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<RwrmGtBDAp2nYwhf>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:22:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<rslqG9BDbtqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 17:22:33 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<eqdfG9BDWNyd5hjP>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:24:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<UjXEINBD4pexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2025-11-17 17:24:06 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:53747: 535 Incorrect authentication data (set_id=tiago.diadio)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-11-17 17:23:50 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:57443: 535 Incorrect authentication data (set_id=michael@deproi.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.42.148.135
country_id: 3469034
description:
2025-11-17 17:23:53 H=(localhost) [179.42.148.135]:21166 F=<hello@localhost> rejected RCPT <CSKo7YmYG0QmUXs@asscar.com.br>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-11-17 17:24:00 dovecot_login authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:43360: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:23:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<nKz/HtBDsIWxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
country_id: 1814991
description:
2025-11-17 17:23:34 dovecot_login authenticator failed for ([60.174.39.82]) [60.174.39.82]:59635: 535 Incorrect authentication data (set_id=tiago.diadio@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2025-11-17 17:23:48 dovecot_login authenticator failed for ([211.93.6.230]) [211.93.6.230]:23040: 535 Incorrect authentication data (set_id=tiago.diadio@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2025-11-17 17:24:12 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:46854: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2025-11-17 17:24:17 dovecot_login authenticator failed for ([65.191.211.33]) [65.191.211.33]:42718: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 17:24:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@friendlyhand.org>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<ArjhItBD0pdns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2025-11-17 17:24:53 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:55232: 535 Incorrect authentication data (set_id=juliana@vidaengenharia.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 59.24.133.197
country_id: 1835841
description:
Nov 17 17:24:58 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@dlmoveis.com.br>, method=PLAIN, rip=59.24.133.197, lip=200.150.196.245, session=<Ler8I9BDsLM7GIXF>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:24:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<c9OTItBDjKSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-11-17 17:24:40 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:42516: 535 Incorrect authentication data (set_id=michael)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 17:24:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<4xDkINBDasUkMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.216.181.233
country_id: 2661886
description:
2025-11-17 17:24:22 dovecot_login authenticator failed for c80-216-181-233.bredband.tele2.se [80.216.181.233]:41680: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2025-11-17 17:24:35 dovecot_login authenticator failed for ([218.156.93.202]) [218.156.93.202]:35071: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 17:24:37 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@lixadorajl.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<6ba/ItBDQLkIjQ01>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.56.116
country_id: 3017382
description:
2025-11-17 17:24:57 dovecot_login authenticator failed for laubervilliers-657-1-120-116.w80-14.abo.wanadoo.fr [80.14.56.116]:58803: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.42.148.135
country_id: 3469034
description:
2025-11-17 17:24:10 H=(localhost) [179.42.148.135]:21166 F=<hello@localhost> rejected RCPT <contato@asscar.com.br>: Sender verify failed


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 17:24:36 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<+VmtItBDCtfSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2025-11-17 17:24:37 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:32926: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-11-17 17:24:39 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:36190: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.135.236.42
country_id: 2017370
description:
2025-11-17 17:24:52 dovecot_login authenticator failed for ([79.135.236.42]) [79.135.236.42]:60966: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.81.213.111
country_id: 2017370
description:
2025-11-17 17:24:53 dovecot_login authenticator failed for ([78.81.213.111]) [78.81.213.111]:36787: 535 Incorrect authentication data


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:25:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<tt4qJtBDMMOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-17 17:25:40 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:19994: 535 Incorrect authentication data (set_id=juliana)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 17:25:09 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<tOOcJNBDQL9A44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2025-11-17 17:25:12 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:37494: 535 Incorrect authentication data (set_id=leandro@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2025-11-17 17:25:25 dovecot_login authenticator failed for (nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:45744: 535 Incorrect authentication data (set_id=leandro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.21
country_id: 6252001
description:
2025-11-17 17:25:27 dovecot_login authenticator failed for (ftth-139-60-85-21.hamiltoncom.net) [139.60.85.21]:33094: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-11-17 17:25:29 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:48425: 535 Incorrect authentication data (set_id=paulo@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-17 17:25:50 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:52160: 535 Incorrect authentication data (set_id=paulo)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 17:25:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@fottolegal.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<riVBJ9BD5raGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 17:25:10 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51265: 535 Incorrect authentication data (set_id=info@interlubfiltros.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
country_id: 6252001
description:
2025-11-17 17:25:13 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:54318: 535 Incorrect authentication data (set_id=juliana)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
country_id: 1814991
description:
2025-11-17 17:26:09 dovecot_login authenticator failed for ([121.18.49.14]) [121.18.49.14]:27828: 535 Incorrect authentication data (set_id=cpfnc8@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.27
country_id: 2017370
description:
2025-11-17 17:26:12 dovecot_login authenticator failed for ([46.8.246.27]) [46.8.246.27]:58048: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.183.191.127
country_id: 1562822
description:
2025-11-17 17:26:22 dovecot_login authenticator failed for (static.vnpt.vn) [113.183.191.127]:54026: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-17 17:26:46 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:38384: 535 Incorrect authentication data (set_id=memaagostinho)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.148.205
country_id: 2017370
description:
2025-11-17 17:26:48 dovecot_login authenticator failed for ([92.124.148.205]) [92.124.148.205]:55050: 535 Incorrect authentication data (set_id=cpfnc8)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:27:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xTyBK9BDEoGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.199.126
country_id: 1269750
description:
2025-11-17 17:26:07 dovecot_login authenticator failed for ([182.79.31.107]) [152.52.199.126]:58776: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.16.40.3
country_id: 1814991
description:
2025-11-17 17:26:26 dovecot_login authenticator failed for ([110.16.40.3]) [110.16.40.3]:52158: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
country_id: 6252001
description:
2025-11-17 17:26:29 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:53988: 535 Incorrect authentication data (set_id=cpfnc8@cartoriopinheirinho.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:26:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Lq2zKdBD4uOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2025-11-17 17:26:37 dovecot_login authenticator failed for ([61.73.190.98]) [61.73.190.98]:33684: 535 Incorrect authentication data (set_id=memaagostinho@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.255.146
country_id: 1814991
description:
2025-11-17 17:26:38 dovecot_login authenticator failed for ([222.170.255.146]) [222.170.255.146]:41370: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-11-17 17:27:52 dovecot_login authenticator failed for ([121.128.76.109]) [61.72.59.106]:53259: 535 Incorrect authentication data (set_id=laudicea.aquino@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.12.86.90
country_id: 1269750
description:
2025-11-17 17:27:54 dovecot_login authenticator failed for (mail.tataidc.com) [61.12.86.90]:51974: 535 Incorrect authentication data (set_id=compras@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.159.230
country_id: 1835841
description:
2025-11-17 17:28:00 dovecot_login authenticator failed for ([220.72.159.230]) [220.72.159.230]:41534: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:27:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<yq9JLdBD9I2xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.1.60.243
country_id: 1605651
description:
Nov 17 17:27:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@profetizandoasmulheres.com.br>, method=PLAIN, rip=210.1.60.243, lip=200.150.196.245, session=<6CrLLdBDyMvSATzz>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2025-11-17 17:27:46 dovecot_login authenticator failed for ([182.95.52.194]) [182.95.52.194]:60476: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.61.244
country_id: 1814991
description:
2025-11-17 17:28:10 dovecot_login authenticator failed for ([111.26.61.243]) [111.26.61.244]:54064: 535 Incorrect authentication data (set_id=compras)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:28:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<B5PcMNBDOtaxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 17:28:59 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<J8BdMtBDbLfSchJs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.34.174.90
country_id: 1814991
description:
2025-11-17 17:28:51 dovecot_login authenticator failed for ([58.34.174.90]) [58.34.174.90]:59229: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.175
country_id: 3865483
description:
2025-11-17 17:29:04 dovecot_login authenticator failed for (red.170.233.29.175.ssservicios.com.ar) [170.233.29.175]:43184: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 17:28:11 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<k2d2L9BDUI9n9M4G>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.61.54.87
country_id: 6252001
description:
[2025-11-17 17:28:27 -0300] info [cpaneld] 45.61.54.87 - 2083 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-11-17 17:28:27 dovecot_login authenticator failed for ([122.187.227.199]) [122.187.227.199]:43300: 535 Incorrect authentication data (set_id=laudicea.aquino)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 17:28:31 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@huboperacoes.com>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<qCGyMNBD3rtSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-11-17 17:28:14 dovecot_login authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:51613: 535 Incorrect authentication data (set_id=laudicea.aquino@vidaengenharia.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 17:28:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@implementarconsultoria.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<jx+gMNBDwJcIjQ01>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.95.221
country_id: 2017370
description:
2025-11-17 17:28:44 dovecot_login authenticator failed for broadband-178-140-95-221.ip.moscow.rt.ru [178.140.95.221]:35237: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
country_id: 3923057
description:
2025-11-17 17:28:56 dovecot_login authenticator failed for (SCZ-181-188-149-00243.tigo.bo) [181.188.149.243]:49155: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:29:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<3Wt7NNBDKImxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2025-11-17 17:29:35 dovecot_login authenticator failed for ([111.61.176.245]) [111.61.176.245]:33410: 535 Incorrect authentication data (set_id=edineia@letracaixa.art.br)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 179.0.178.53
country_id: 3469034
description:
2025-11-17 17:29:42 H=(195.3.134.135) [179.0.178.53]:57841 F=<erictremblaysi@hotmail.com> rejected RCPT <mdvendas@transol.com.br>: "JunkMail rejected - (195.3.134.135) [179.0.178.53]:57841 is in an RBL: Listed by PBL, see https://check.spamhaus.org/query/ip/179.0.178.53"


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
country_id: 690791
description:
2025-11-17 17:29:55 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:39937: 535 Incorrect authentication data (set_id=ivanski.rodrigo@vidaengenharia.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:30:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0hVDNtBDGpSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.236.145.188
country_id: 3996063
description:
2025-11-17 17:29:22 dovecot_login authenticator failed for ([177.236.145.188]) [177.236.145.188]:39298: 535 Incorrect authentication data (set_id=info@lixadoracuritiba.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:30:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Z+gLONBDIqSxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 183.215.179.154
country_id: 1814991
description:
Nov 17 17:30:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@dlmoveis.com.br>, method=PLAIN, rip=183.215.179.154, lip=200.150.196.245, session=<tdn7N9BDcAu317Oa>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.131.40
country_id: 130758
description:
2025-11-17 17:30:36 dovecot_login authenticator failed for (ADMIN) [62.60.131.40]:64868: 535 Incorrect authentication data (set_id=webmaster@deproi.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 17:30:52 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@calcautomacao.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<C8YaOdBDsLtns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-11-17 17:30:05 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:33423: 535 Incorrect authentication data (set_id=edineia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
country_id: 1814991
description:
2025-11-17 17:30:21 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.73.174]:27040: 535 Incorrect authentication data (set_id=ivanski.rodrigo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.25.161
country_id: 1668284
description:
2025-11-17 17:30:29 dovecot_login authenticator failed for 111-70-25-161.emome-ip.hinet.net [111.70.25.161]:54426: 535 Incorrect authentication data (set_id=edineia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.199
country_id: 1269750
description:
2025-11-17 17:31:43 dovecot_login authenticator failed for ([122.187.227.199]) [122.187.227.199]:53902: 535 Incorrect authentication data (set_id=pedagogico)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2025-11-17 17:31:56 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:34502: 535 Incorrect authentication data (set_id=505657469286137@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.161.31.172
country_id: 1562822
description:
2025-11-17 17:31:28 dovecot_login authenticator failed for (static.vnpt.vn) [14.161.31.172]:24081: 535 Incorrect authentication data (set_id=pedagogico@educacionalevangelico.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:31:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OtGWO9BDFMGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2025-11-17 17:31:23 dovecot_login authenticator failed for ([111.61.177.190]) [111.61.177.190]:32580: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.6.108.13
country_id: 1814991
description:
2025-11-17 17:31:29 dovecot_login authenticator failed for ([119.6.108.13]) [119.6.108.13]:47902: 535 Incorrect authentication data (set_id=jesse@vidaengenharia.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-17 17:31:39 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:33526: 535 Incorrect authentication data (set_id=jesse)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2025-11-17 17:31:09 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:54818: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 17 17:31:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@prolip.com.br>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<U3+ZOtBDrpynYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.188.178.23
country_id: 6252001
description:
2025-11-17 17:32:36 dovecot_login authenticator failed for syn-108-188-178-023.biz.spectrum.com [108.188.178.23]:51789: 535 Incorrect authentication data (set_id=bianca.user.it@globalmedica.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-11-17 17:32:47 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:37560: 535 Incorrect authentication data (set_id=mecati)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.148.100.210
country_id: 2017370
description:
2025-11-17 17:32:54 dovecot_login authenticator failed for ([46.148.100.210]) [46.148.100.210]:54130: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.204.125.124
country_id: 1835841
description:
2025-11-17 17:33:03 dovecot_login authenticator failed for ([119.204.125.124]) [119.204.125.124]:7646: 535 Incorrect authentication data (set_id=bianca.user.it)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-11-17 17:32:06 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:44110: 535 Incorrect authentication data (set_id=505657469286137)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:32:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<8pI0P9BDTuGxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.145
country_id: 1668284
description:
2025-11-17 17:32:54 dovecot_login authenticator failed for 110-25-112-145.adsl.fetnet.net [110.25.112.145]:53171: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:33:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<c/vxQNBDEuyxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
country_id: 1814991
description:
2025-11-17 17:32:06 dovecot_login authenticator failed for ([111.61.97.5]) [111.61.97.5]:61526: 535 Incorrect authentication data (set_id=mecati@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.231.3.246
country_id: 3017382
description:
2025-11-17 17:33:21 dovecot_login authenticator failed for ([188.231.3.246]) [188.231.3.246]:35600: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2025-11-17 17:33:36 dovecot_login authenticator failed for ([196.0.107.158]) [196.0.107.158]:57493: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
country_id: 1668284
description:
2025-11-17 17:33:47 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:33508: 535 Incorrect authentication data (set_id=bruno.garcia@deproi.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2025-11-17 17:33:58 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:33440: 535 Incorrect authentication data (set_id=bruno.garcia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.63
country_id: 99237
description:
2025-11-17 17:33:10 dovecot_login authenticator failed for ([65.20.174.63]) [65.20.174.63]:50981: 535 Incorrect authentication data (set_id=paulo.user.it@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.199.161.79
country_id: 597427
description:
2025-11-17 17:33:24 dovecot_login authenticator failed for ip-5-199-161-79.010.ptr.cherryservers.net [5.199.161.79]:39164: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:33:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZPHCQtBDepCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.131.243.102
country_id: 1814991
description:
2025-11-17 17:33:31 dovecot_login authenticator failed for ([183.131.243.102]) [183.131.243.102]:35606: 535 Incorrect authentication data (set_id=paulo.user.it)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.169.71.110
country_id: 1814991
description:
2025-11-17 17:34:06 dovecot_login authenticator failed for (92.84.8.221.adsl-pool.jlccptt.net.cn) [222.169.71.110]:8949: 535 Incorrect authentication data (set_id=contato@tvadnp.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 17:34:24 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@bethelpaintinginc.com>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<kry9RdBD1oRns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-11-17 17:34:26 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:57135: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 200.110.153.22
country_id: 3703430
description:
[2025-11-17 17:34:27 -0300] info [webmaild] 200.110.153.22 - junior.gomes@sindeesfort.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:34:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6dFPRtBDqKixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.85.21
country_id: 6252001
description:
2025-11-17 17:34:37 dovecot_login authenticator failed for (ftth-139-60-85-21.hamiltoncom.net) [139.60.85.21]:45431: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.77.179.159
country_id: 3617476
description:
2025-11-17 17:34:21 dovecot_login authenticator failed for (159-179-77-186.enitel.net.ni) [186.77.179.159]:54642: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 195.181.163.129
country_id: 6252001
description:
[2025-11-17 17:34:26 -0300] info [webmaild] 195.181.163.129 - junior.gomes@sindeesfort.com.br "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:36:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<4p+5S9BD5tqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.168.100
country_id: 6252001
description:
2025-11-17 17:36:03 dovecot_login authenticator failed for ([70.174.168.100]) [70.174.168.100]:45095: 535 Incorrect authentication data (set_id=contato@inovasite.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:35:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<U+XvSdBD7sexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 17:35:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@lixadorajl.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<Irw+S9BDAOpn9M4G>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
country_id: 3686110
description:
2025-11-17 17:35:57 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:40763: 535 Incorrect authentication data (set_id=assessoria@cantoramaralima.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-17 17:36:30 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:57472: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:36:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<w799TdBDLOuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-11-17 17:36:50 dovecot_login authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:38572: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.26.106
country_id: 1814991
description:
2025-11-17 17:36:51 dovecot_login authenticator failed for ([58.240.26.106]) [58.240.26.106]:64673: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2025-11-17 17:36:52 dovecot_login authenticator failed for ([197.219.228.242]) [197.219.228.242]:35158: 535 Incorrect authentication data (set_id=cpfnc2@cartoriopinheirinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.245.186.121
country_id: 1643084
description:
2025-11-17 17:37:05 dovecot_login authenticator failed for (ipv4-124-186-245-43.as55666.net) [43.245.186.121]:56744: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.118
country_id: 1814991
description:
2025-11-17 17:36:07 dovecot_login authenticator failed for ([111.61.175.118]) [111.61.175.118]:30842: 535 Incorrect authentication data (set_id=assessoria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
country_id: 2510769
description:
2025-11-17 17:36:22 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:53982: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 17:37:04 dovecot_login authenticator failed for (User) [177.74.174.120]:63986: 535 Incorrect authentication data (set_id=silva@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.115.29.39
country_id: 1835841
description:
2025-11-17 17:36:08 dovecot_login authenticator failed for ([175.115.29.39]) [175.115.29.39]:45129: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.232.46.23
country_id: 1814991
description:
2025-11-17 17:37:34 dovecot_login authenticator failed for ([116.232.46.23]) [116.232.46.23]:48481: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.213.242
country_id: 3469034
description:
2025-11-17 17:37:53 dovecot_login authenticator failed for ([200.164.226.113]) [200.149.213.242]:60397: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 17 17:38:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@joelbuenoadvogados.com.br>, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=<K++sUtBDJtdnOJRs>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.79.255.104
country_id: 2017370
description:
2025-11-17 17:37:14 dovecot_login authenticator failed for ([37.79.255.104]) [37.79.255.104]:43413: 535 Incorrect authentication data (set_id=cpfnc2)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:37:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<y8EMUdBDXJuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.31.135
country_id: 1668284
description:
2025-11-17 17:37:31 dovecot_login authenticator failed for 111-70-31-135.emome-ip.hinet.net [111.70.31.135]:36096: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 51.77.141.29
country_id: 3017382
description:
Nov 17 17:37:40 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@profetizandoasmulheres.com.br>, method=PLAIN, rip=51.77.141.29, lip=200.150.196.245, session=<GfxkUdBDbs0zTY0d>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 17:37:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@joelbuenoadvogados.com.br>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<rtxMUtBDwNul0xnK>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 17:37:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@prolip.com.br>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<bYZVUtBDGMmvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 17:37:10 dovecot_login authenticator failed for (User) [177.74.174.120]:63986: 535 Incorrect authentication data (set_id=silva@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.205.104
country_id: 2017370
description:
2025-11-17 17:38:46 dovecot_login authenticator failed for ([88.84.205.104]) [88.84.205.104]:44232: 535 Incorrect authentication data (set_id=ferramentaria)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:38:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Z/2mVNBDgLSxV3kv>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:39:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<Z5tzVtBDDMixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.171.116
country_id: 99237
description:
2025-11-17 17:38:06 dovecot_login authenticator failed for ([65.20.171.116]) [65.20.171.116]:34861: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.141.143.58
country_id: 1835841
description:
2025-11-17 17:38:16 dovecot_login authenticator failed for ([115.141.143.58]) [115.141.143.58]:44047: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.248.94.49
country_id: 1562822
description:
2025-11-17 17:38:18 dovecot_login authenticator failed for ([14.248.94.49]) [14.248.94.49]:47394: 535 Incorrect authentication data (set_id=maia@maringaparts.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 17:38:46 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@ufadville.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<AbhZVdBDzN4IjQ01>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.200.10
country_id: 1269750
description:
2025-11-17 17:38:46 dovecot_login authenticator failed for ([125.19.175.85]) [122.186.200.10]:56310: 535 Incorrect authentication data (set_id=eliezer)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.67.123.202
country_id: 1814991
description:
2025-11-17 17:38:26 dovecot_login authenticator failed for ([218.67.123.202]) [218.67.123.202]:57857: 535 Incorrect authentication data (set_id=eliezer@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2025-11-17 17:38:32 dovecot_login authenticator failed for ([1.212.225.99]) [1.212.225.99]:60280: 535 Incorrect authentication data (set_id=ferramentaria@maringasoldas.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.24.148.249
country_id: 1562822
description:
2025-11-17 17:38:33 dovecot_login authenticator failed for ([123.24.148.249]) [123.24.148.249]:34627: 535 Incorrect authentication data (set_id=maia)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-11-17 17:38:42 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:56900: 535 Incorrect authentication data (set_id=comercial.user.it@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 17:38:55 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:51889: 535 Incorrect authentication data (set_id=sales@implementarconsultoria.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.4.78.74
country_id: 1814991
description:
2025-11-17 17:39:19 dovecot_login authenticator failed for ([111.4.78.74]) [111.4.78.74]:41456: 535 Incorrect authentication data (set_id=comercial.user.it)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.50.162.66
country_id: 2017370
description:
2025-11-17 17:39:25 dovecot_login authenticator failed for ([94.50.162.66]) [94.50.162.66]:60413: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:39:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SxY6WNBDoNuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.226
country_id: 798549
description:
2025-11-17 17:40:04 dovecot_login authenticator failed for (ADMIN) [193.32.162.226]:40326: 535 Incorrect authentication data (set_id=comercial@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.216.104
country_id: 3996063
description:
2025-11-17 17:39:06 dovecot_login authenticator failed for (201.173.216.104-clientes-izzi.mx) [201.173.216.104]:39375: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 17:39:07 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ufadville.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<M7KWVtBDltRA44h6>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:40:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<1tbNW9BDBpCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 17:40:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@implementarconsultoria.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<FrUNXdBD5qVn9M4G>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:41:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+kBfX9BDsrqxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 17:41:43 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@advsalles.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<3lDgX9BDgMkkMrBu>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:42:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<s08tYdBD9saxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.133.117
country_id: 1835841
description:
2025-11-17 17:42:10 dovecot_login authenticator failed for ([218.146.133.117]) [218.146.133.117]:33168: 535 Incorrect authentication data (set_id=fernandabrum@prafebrum.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.59.34.5
country_id: 1814991
description:
2025-11-17 17:42:18 dovecot_login authenticator failed for ([113.59.34.8]) [113.59.34.5]:41768: 535 Incorrect authentication data (set_id=fernandabrum)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:42:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<OnvvYtBDptOxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.66.47.242
country_id: 1562822
description:
Nov 17 17:42:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@profetizandoasmulheres.com.br>, method=PLAIN, rip=157.66.47.242, lip=200.150.196.245, session=<RNlBZNBDQKCdQi/y>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-11-17 17:43:32 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:54548: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.8.246.183
country_id: 2017370
description:
2025-11-17 17:43:15 dovecot_login authenticator failed for ([46.8.246.183]) [46.8.246.183]:40936: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.19
country_id: 337996
description:
2025-11-17 17:44:03 dovecot_login authenticator failed for ([196.190.180.18]) [196.190.180.19]:24875: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
country_id: 1668284
description:
2025-11-17 17:44:01 dovecot_login authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:58466: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 82.156.231.75
country_id: 1814991
description:
Nov 17 17:44:05 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@joelbuenoadvogados.com.br>, method=PLAIN, rip=82.156.231.75, lip=200.150.196.245, session=<wAJfaNBDfqlSnOdL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.74.174.120
country_id: 3469034
description:
2025-11-17 17:43:18 dovecot_login authenticator failed for (User) [177.74.174.120]:50204: 535 Incorrect authentication data (set_id=silva@inovasite.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.37.60.135
country_id: 2017370
description:
2025-11-17 17:43:52 dovecot_login authenticator failed for ([78.37.60.135]) [78.37.60.135]:51290: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2025-11-17 17:43:54 dovecot_login authenticator failed for ([181.115.237.19]) [181.115.237.19]:50412: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.58.241.90
country_id: 3469034
description:
2025-11-17 17:43:55 dovecot_login authenticator failed for (ccabv.org.cta.gvt.net.br) [187.58.241.90]:36469: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.11.135
country_id: 1814991
description:
2025-11-17 17:43:53 dovecot_login authenticator failed for ([61.150.11.135]) [61.150.11.135]:43492: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 17:44:04 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@transol.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<TJpFaNBDkPtxoZB3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
country_id: 1835841
description:
2025-11-17 17:43:11 dovecot_login authenticator failed for ([211.196.31.2]) [211.196.31.2]:50492: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.12.132.157
country_id: 1269750
description:
2025-11-17 17:43:27 dovecot_login authenticator failed for (rev.perfectinternet.in) [103.12.132.157]:58738: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:43:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</VR/ZtBDgoaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.234.48.147
country_id: 1814991
description:
2025-11-17 17:43:40 dovecot_login authenticator failed for ([221.234.48.147]) [221.234.48.147]:52586: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.13.23
country_id: 1668284
description:
2025-11-17 17:44:07 dovecot_login authenticator failed for 111-70-13-23.emome-ip.hinet.net [111.70.13.23]:37495: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.63.87
country_id: 1814991
description:
2025-11-17 17:44:10 dovecot_login authenticator failed for ([111.26.63.86]) [111.26.63.87]:54300: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.84.162.177
country_id: 1861060
description:
2025-11-17 17:44:21 dovecot_login authenticator failed for 177.162.84.34.bc.googleusercontent.com [34.84.162.177]:61578: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2025-11-17 17:44:24 dovecot_login authenticator failed for ([103.251.31.154]) [103.251.31.154]:51128: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.149.67.200
country_id: 1814991
description:
2025-11-17 17:44:47 dovecot_login authenticator failed for ([182.149.67.200]) [182.149.67.200]:50766: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:45:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<x+vja9BDgryxV3kv>


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 187.16.187.141
country_id: 3469034
description:
2025-11-17 17:44:15 H=(localhost) [187.16.187.141]:17786 F=<hello@localhost> rejected RCPT <3BZGXETqqjZYA24@box911.com.br>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.98.144.36
country_id: 1269750
description:
2025-11-17 17:44:17 dovecot_login authenticator failed for ([59.98.144.36]) [59.98.144.36]:40003: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2025-11-17 17:44:19 dovecot_login authenticator failed for ([182.95.223.46]) [182.95.223.46]:36634: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:44:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<SAEaatBDPK+xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 23.95.63.99
country_id: 6252001
description:
Nov 17 17:44:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@pirajusolucoes.com.br>, method=PLAIN, rip=23.95.63.99, lip=200.150.196.245, session=<IXTwadBDjtMXXz9j>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 17:44:45 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fanatef.com.br>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<ghy4atBDLJA+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.67.120.106
country_id: 1814991
description:
2025-11-17 17:45:52 dovecot_login authenticator failed for ([124.67.120.106]) [124.67.120.106]:60019: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.58.215.72
country_id: 1819730
description:
2025-11-17 17:46:05 dovecot_login authenticator failed for (ADMIN) [123.58.215.72]:58076: 535 Incorrect authentication data (set_id=admin@jacgeneralcleaning.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.85.118.147
country_id: 1814991
description:
2025-11-17 17:45:18 dovecot_login authenticator failed for ([111.85.118.147]) [111.85.118.147]:43469: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 91.238.166.52
country_id: 798544
description:
Nov 17 17:45:25 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<novidadevida@1075fm.com.br>, method=PLAIN, rip=91.238.166.52, lip=200.150.196.245, TLS, session=<d9o6bNBDuM5b7qY0>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:45:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<6kmwbdBDoM+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.79.112
country_id: 1814991
description:
2025-11-17 17:45:41 dovecot_login authenticator failed for ([111.26.79.111]) [111.26.79.112]:36590: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.42.52.79
country_id: 1835841
description:
2025-11-17 17:46:44 dovecot_login authenticator failed for ([118.42.52.79]) [118.42.52.79]:56971: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2025-11-17 17:46:58 dovecot_login authenticator failed for 221-120-57-125.emome-ip.hinet.net [221.120.57.125]:44712: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.107.57
country_id: 1814991
description:
2025-11-17 17:47:04 dovecot_login authenticator failed for ([36.135.107.56]) [36.135.107.57]:54192: 535 Incorrect authentication data (set_id=atendimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.243.24.178
country_id: 1814991
description:
2025-11-17 17:46:13 dovecot_login authenticator failed for ([223.243.24.178]) [223.243.24.178]:60286: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-11-17 17:46:19 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:58620: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:46:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ZJ5AcdBDmOixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.92.57
country_id: 1168579
description:
2025-11-17 17:46:38 dovecot_login authenticator failed for (57.92.zcomnetworks.com.pk) [103.148.92.57]:58587: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
country_id: 1269750
description:
2025-11-17 17:46:42 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:46933: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.201.59.224
country_id: 1835841
description:
2025-11-17 17:47:00 dovecot_login authenticator failed for ([119.201.59.224]) [119.201.59.224]:40982: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.245.87
country_id: 2510769
description:
2025-11-17 17:46:13 dovecot_login authenticator failed for (h-91-126-245-87.wholesale.adamo.es) [91.126.245.87]:40914: 535 Incorrect authentication data (set_id=eduardo@rreguimaraes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.189.80.73
country_id: 2510769
description:
2025-11-17 17:46:25 dovecot_login authenticator failed for 73.pool92-189-80.dynamic.orange.es [92.189.80.73]:55560: 535 Incorrect authentication data (set_id=atendimento@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.220.30
country_id: 1269750
description:
2025-11-17 17:46:32 dovecot_login authenticator failed for ([125.17.106.225]) [122.187.220.30]:55766: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.79.21
country_id: 1814991
description:
2025-11-17 17:47:06 dovecot_login authenticator failed for (251.78.212.118.adsl-pool.jx.chinaunicom.com) [118.212.79.21]:49734: 535 Incorrect authentication data (set_id=eduardo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
country_id: 1814991
description:
2025-11-17 17:47:15 dovecot_login authenticator failed for ([113.219.177.95]) [113.219.177.95]:42244: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:47:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<TtbPdNBDoKuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.198.128.124
country_id: 1835841
description:
2025-11-17 17:47:21 dovecot_login authenticator failed for ([211.198.128.124]) [211.198.128.124]:60816: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.43.184.202
country_id: 1814991
description:
2025-11-17 17:47:23 dovecot_login authenticator failed for ([112.109.198.106]) [175.43.184.202]:55456: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.20.193
country_id: 290557
description:
2025-11-17 17:47:31 dovecot_login authenticator failed for ([94.207.20.193]) [94.207.20.193]:45631: 535 Incorrect authentication data (set_id=andre.nascimento@calcautomacao.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.254.162
country_id: 1269750
description:
2025-11-17 17:47:34 dovecot_login authenticator failed for ([152.52.204.27]) [128.185.254.162]:48582: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2025-11-17 17:47:44 dovecot_login authenticator failed for ([103.168.241.32]) [103.168.241.32]:58729: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.201.52
country_id: 1814991
description:
2025-11-17 17:47:47 dovecot_login authenticator failed for ([58.16.201.52]) [58.16.201.52]:49262: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.43.5.222
country_id: 357994
description:
2025-11-17 17:47:56 dovecot_login authenticator failed for ([195.43.5.222]) [195.43.5.222]:57637: 535 Incorrect authentication data (set_id=isabellylisboa)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:48:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<H+2gdtBD8rexV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 113.161.144.119
country_id: 1562822
description:
Nov 17 17:47:17 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@adpiraquara.com.br>, method=PLAIN, rip=113.161.144.119, lip=200.150.196.245, session=<w+LJc9BDtqZxoZB3>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 87.236.176.38
country_id: 2635167
description:
Nov 17 17:47:28 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 7 secs): user=<>, rip=87.236.176.38, lip=191.243.196.56, TLS, session=</YmSdNBD0ZhX7LAm>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.110.215
country_id: 798544
description:
2025-11-17 17:47:34 dovecot_login authenticator failed for 178.183.110.215.mobile.static.t-mobile.pl [178.183.110.215]:55850: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 17:47:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@acqualuzcuritiba.com>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<jH2vddBD6NWl0iHB>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.137
country_id: 130758
description:
Nov 17 17:48:28 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@fourps.com.br>, method=PLAIN, rip=62.60.131.137, lip=200.150.196.245, session=<QbUBeNBDzMk+PIOJ>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:48:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<fAZoeNBDCM2xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.13.61
country_id: 2077456
description:
2025-11-17 17:48:40 dovecot_login authenticator failed for ([120.157.13.61]) [120.157.13.61]:34788: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 17:48:48 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadorajl.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=</glBedBDuLtA44h6>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 134.199.201.205
country_id: 6252001
description:
Nov 17 17:48:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@portaldascontempladas.com.br>, method=PLAIN, rip=134.199.201.205, lip=200.150.196.245, session=<nhCcedBDMtCGx8nN>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.199.10.82
country_id: 3175395
description:
2025-11-17 17:48:12 dovecot_login authenticator failed for host-31-199-10-82.business.telecomitalia.it [31.199.10.82]:51319: 535 Incorrect authentication data (set_id=andre.nascimento)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.54.10
country_id: 1269750
description:
2025-11-17 17:48:21 dovecot_login authenticator failed for ([182.95.54.10]) [182.95.54.10]:57530: 535 Incorrect authentication data (set_id=salamuni@salamuni.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 17:49:25 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@acqualuzcuritiba.com>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<P15oe9BD2KQnaoFh>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:49:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5EX9e9BDloCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.179.188.146
country_id: 1562822
description:
Nov 17 17:49:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ceramicamonallisa.com.br>, method=PLAIN, rip=103.179.188.146, lip=200.150.196.245, session=<RHfce9BDpJpns7yS>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.115.38
country_id: 1269750
description:
2025-11-17 17:49:43 dovecot_login authenticator failed for ([182.95.115.38]) [182.95.115.38]:36110: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 17:49:50 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@ilumix.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<fsnmfNBDkAto7MS0>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
country_id: 49518
description:
2025-11-17 17:49:56 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:44520: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
country_id: 1814991
description:
2025-11-17 17:51:01 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:36867: 535 Incorrect authentication data (set_id=marialuiza)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 17:51:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadoracuritiba.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<bgJBgdBD9uWd5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.89.122
country_id: 1814991
description:
2025-11-17 17:50:20 dovecot_login authenticator failed for ([60.216.89.122]) [60.216.89.122]:44976: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.122.211.212
country_id: 1814991
description:
2025-11-17 17:50:27 dovecot_login authenticator failed for (radiosarabrasil.fm.br) [111.122.211.212]:64282: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.60.23.246
country_id: 895949
description:
2025-11-17 17:50:36 dovecot_login authenticator failed for ([41.60.23.246]) [41.60.23.246]:34072: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.244.34
country_id: 1269750
description:
2025-11-17 17:50:41 dovecot_login authenticator failed for (nsg-corporate-34.244.186.122.airtel.in) [122.186.244.34]:44354: 535 Incorrect authentication data (set_id=alex.vendas)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 62.60.131.139
country_id: 130758
description:
Nov 17 17:50:54 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@brinquelocacoes.com>, method=PLAIN, rip=62.60.131.139, lip=200.150.196.245, session=<eozAgNBDgJA+PIOL>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.241
country_id: 6252001
description:
2025-11-17 17:50:28 dovecot_login authenticator failed for ([208.69.161.241]) [208.69.161.241]:56220: 535 Incorrect authentication data (set_id=alex.vendas@maringaparts.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:50:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<W/uIf9BDFKexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-11-17 17:50:42 dovecot_login authenticator failed for (165-220-130-160.cust.exede.net) [165.220.130.160]:33922: 535 Incorrect authentication data (set_id=marialuiza@8it.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:51:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ep9XgdBDbLixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.215.70
country_id: 2233387
description:
2025-11-17 17:51:16 dovecot_login authenticator failed for ([195.24.215.70]) [195.24.215.70]:43936: 535 Incorrect authentication data (set_id=andre.nascimento.it@calcautomacao.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 39.106.129.97
country_id: 1814991
description:
Nov 17 17:51:30 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@ieq.com.br>, method=PLAIN, rip=39.106.129.97, lip=200.150.196.245, session=<tEDlgtBDqJUnaoFh>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:51:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<d9olg9BDJMqxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
country_id: 1814991
description:
2025-11-17 17:51:34 dovecot_login authenticator failed for ([122.225.203.106]) [122.225.203.106]:15190: 535 Incorrect authentication data (set_id=info.user.it@lixadoracuritiba.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
country_id: 3865483
description:
2025-11-17 17:51:45 dovecot_login authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:35668: 535 Incorrect authentication data (set_id=andre.nascimento.it)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.62.41
country_id: 1814991
description:
2025-11-17 17:52:04 dovecot_login authenticator failed for ([1.180.62.41]) [1.180.62.41]:47128: 535 Incorrect authentication data (set_id=andressa.financeiro@maringaparts.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-11-17 17:52:17 dovecot_login authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:35082: 535 Incorrect authentication data (set_id=info.user.it)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 17:52:18 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@calcautomacao.com>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<M6K9hdBDEoJ9gnHM>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.93.170
country_id: 1269750
description:
2025-11-17 17:52:57 dovecot_login authenticator failed for (nsg-static-121.34.76.182-airtel.com) [182.78.93.170]:46098: 535 Incorrect authentication data (set_id=xavier)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 177.85.138.85
country_id: 3469034
description:
Nov 17 17:52:15 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos@maringasoldas.com.br>, method=PLAIN, rip=177.85.138.85, lip=200.150.196.245, TLS, session=<aWudhNBDCsixVYpV>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.84.155.190
country_id: 6252001
description:
2025-11-17 17:52:15 dovecot_login authenticator failed for (pool-162-84-155-190.nycmny.fios.verizon.net) [162.84.155.190]:39630: 535 Incorrect authentication data (set_id=andressa.financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:52:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<vom7htBDZumxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.137.151.93
country_id: 1814991
description:
2025-11-17 17:52:43 dovecot_login authenticator failed for ([180.137.151.93]) [180.137.151.93]:60285: 535 Incorrect authentication data (set_id=xavier@projetocircense.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.18.166.128
country_id: 1269750
description:
Nov 17 17:52:49 hosting dovecot: imap-login: Disconnected: Connection closed (user disabled): user=<andreza.santos>, method=PLAIN, rip=103.18.166.128, lip=200.150.196.245, TLS, session=<ORVyhtBDrs5nEqaA>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.85.230.107
country_id: 630336
description:
2025-11-17 17:53:57 dovecot_login authenticator failed for (mm-107-230-85-93.static.minsktelecom.by) [93.85.230.107]:53578: 535 Incorrect authentication data (set_id=fabio.vendas@maringaparts.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:54:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0I4VjNBDPquxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 104.236.196.180
country_id: 6252001
description:
Nov 17 17:53:06 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@emersonestofados.com.br>, method=PLAIN, rip=104.236.196.180, lip=200.150.196.245, session=<cGCkiNBDUAVo7MS0>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:53:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<5hhEitBDcJexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.212.110.237
country_id: 3144096
description:
2025-11-17 17:53:31 dovecot_login authenticator failed for (cm-46.212.110.237.get.no) [46.212.110.237]:49321: 535 Incorrect authentication data (set_id=contato@airfluxparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.2.243.174
country_id: 1814991
description:
2025-11-17 17:53:46 dovecot_login authenticator failed for (contabilidadefollador.com.br) [60.2.243.174]:40556: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 175.126.37.247
country_id: 1835841
description:
Nov 17 17:53:53 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@calcautomacao.com>, method=PLAIN, rip=175.126.37.247, lip=200.150.196.245, session=<AD9fi9BDEhCvfiX3>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.2.243.174
country_id: 1814991
description:
2025-11-17 17:54:11 dovecot_login authenticator failed for (contabilidadefollador.com.br) [60.2.243.174]:43882: 535 Incorrect authentication data (set_id=admin@contabilidadefollador.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:54:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<z2vWjdBD3raxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.116.236.137
country_id: 298795
description:
2025-11-17 17:54:43 dovecot_login authenticator failed for (ADMIN) [194.116.236.137]:49494: 535 Incorrect authentication data (set_id=contato@toromartelinho.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.121.234.5
country_id: 1814991
description:
2025-11-17 17:54:57 dovecot_login authenticator failed for ([118.121.233.158]) [118.121.234.5]:47054: 535 Incorrect authentication data (set_id=contato@compensadosparana.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.21.18
country_id: 3469034
description:
2025-11-17 17:54:08 dovecot_login authenticator failed for (187.95.21.18.netjacarei.nipcable.com) [187.95.21.18]:46570: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.61.137
country_id: 1562822
description:
2025-11-17 17:54:09 dovecot_login authenticator failed for ([171.244.61.137]) [171.244.61.137]:22859: 535 Incorrect authentication data (set_id=fabio.vendas)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:55:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<0YV3kdBD2NaxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.213.9
country_id: 3469034
description:
2025-11-17 17:55:43 dovecot_plain authenticator failed for ([192.168.1.13]) [104.28.213.9]:42682: 535 Incorrect authentication data (set_id=contato@acmesolar.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.213.8
country_id: 3469034
description:
2025-11-17 17:55:54 dovecot_plain authenticator failed for ([192.168.1.13]) [104.28.213.8]:32808: 535 Incorrect authentication data (set_id=contato@acmesolar.com.br)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 177.135.232.235
country_id: 3469034
description:
[2025-11-17 17:55:13 -0300] info [webmaild] 177.135.232.235 - diretoria@eaglebpo.com.br "GET /cpsess6120534665/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2025-11-17 17:55:18 dovecot_login authenticator failed for ([65.20.237.191]) [65.20.237.191]:38321: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.182
country_id: 2017370
description:
2025-11-17 17:55:20 dovecot_login authenticator failed for ([31.173.2.182]) [31.173.2.182]:38500: 535 Incorrect authentication data (set_id=envios@comercial.art.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-11-17 17:55:32 dovecot_login authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:42694: 535 Incorrect authentication data (set_id=envios)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:56:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<i3gHldBDXoSxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.25.64
country_id: 3686110
description:
2025-11-17 17:56:41 dovecot_login authenticator failed for (1522312565.colombiatel.co) [152.231.25.64]:52472: 535 Incorrect authentication data (set_id=contato@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.30.248.213
country_id: 2017370
description:
2025-11-17 17:57:01 dovecot_login authenticator failed for broadband-85-30-248-213.ip.moscow.rt.ru [85.30.248.213]:60096: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:57:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<I8nMltBDvJexV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.121.231
country_id: 1605651
description:
2025-11-17 17:57:25 dovecot_login authenticator failed for (ADMIN) [165.154.121.231]:55597: 535 Incorrect authentication data (set_id=admin@interlubfiltros.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:57:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<jLacmNBD6KKxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 125.130.113.204
country_id: 1835841
description:
Nov 17 17:57:47 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<info@prolip.com.br>, method=PLAIN, rip=125.130.113.204, lip=200.150.196.245, session=<ValcmdBDesx9gnHM>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.56.148.108
country_id: 1643084
description:
Nov 17 17:58:10 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<contact@huboperacoes.com>, method=PLAIN, rip=103.56.148.108, lip=200.150.196.245, session=<YnW4mtBD5O1nOJRs>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:58:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<+r0rnNBD8MCxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.140.218
country_id: 3017382
description:
2025-11-17 17:58:49 dovecot_login authenticator failed for 82-65-140-218.subs.proxad.net [82.65.140.218]:53534: 535 Incorrect authentication data (set_id=ieqcampocomprido@ieq.com.br)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 17:59:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<IcO7n9BD9t+xV3kv>


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 191.177.160.64
country_id: 3469034
description:
[2025-11-17 17:59:42 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "GET /cpsess2402986023/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 157.230.24.207
country_id: 2921044
description:
Nov 17 17:59:49 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@advsalles.com.br>, method=PLAIN, rip=157.230.24.207, lip=200.150.196.245, session=<3HCooNBDdNad5hjP>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-11-17 18:00:02 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:8072: 535 Incorrect authentication data (set_id=venesselume@louvoreterno.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:00:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<WrSJodBDouuxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
country_id: 458258
description:
2025-11-17 17:59:06 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:41388: 535 Incorrect authentication data (set_id=ieqcampocomprido)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 191.177.160.64
country_id: 3469034
description:
[2025-11-17 18:01:02 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "GET /cpsess2402986023/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.186
country_id: 1269750
description:
2025-11-17 18:00:16 dovecot_login authenticator failed for ([125.23.235.41]) [182.95.49.186]:52816: 535 Incorrect authentication data (set_id=formula316@1075fm.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.143.205.50
country_id: 690791
description:
2025-11-17 18:00:29 dovecot_login authenticator failed for ([83.143.205.50]) [83.143.205.50]:41753: 535 Incorrect authentication data (set_id=formula316)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:00:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<VONYo9BDbpOxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.194.182
country_id: 3469034
description:
2025-11-17 18:00:50 dovecot_login authenticator failed for ([189.56.5.209]) [187.50.194.182]:40670: 535 Incorrect authentication data (set_id=venesselume)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 167.99.8.95
country_id: 6252001
description:
Nov 17 18:00:55 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@calcautomacao.com>, method=PLAIN, rip=167.99.8.95, lip=200.150.196.245, session=<uFuFpNBDHAunYwhf>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.100.77
country_id: 1814991
description:
2025-11-17 18:00:56 dovecot_login authenticator failed for ([111.26.100.77]) [111.26.100.77]:35760: 535 Incorrect authentication data (set_id=sec.geral@sindeesfort.com.br)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.177.160.64
country_id: 3469034
description:
[2025-11-17 18:01:06 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "POST /login HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.154.166
country_id: 1814991
description:
2025-11-17 18:01:06 dovecot_login authenticator failed for ([122.224.154.166]) [122.224.154.166]:38172: 535 Incorrect authentication data (set_id=contato@pirajusolucoes.com.br)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 5.38.115.28
country_id: 290557
description:
Nov 17 18:01:13 hosting pure-ftpd: (?@5.38.115.28) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 191.177.160.64
country_id: 3469034
description:
[2025-11-17 18:01:31 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "POST /cpsess5074341100/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:01:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=</fzhptBD/KixV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.57.158
country_id: 1269750
description:
2025-11-17 18:01:16 dovecot_login authenticator failed for ([59.144.100.41]) [182.95.57.158]:46080: 535 Incorrect authentication data (set_id=sec.geral)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.32.156
country_id: 1880251
description:
2025-11-17 18:01:31 dovecot_login authenticator failed for (156.32.245.49.unknown.m1.com.sg) [49.245.32.156]:45623: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.89.87
country_id: 690791
description:
2025-11-17 18:01:51 dovecot_login authenticator failed for (host87-89-16-178.reedlan.com) [178.16.89.87]:34061: 535 Incorrect authentication data (set_id=adriana@contabilidadefollador.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
country_id: 2017370
description:
2025-11-17 18:02:06 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:60612: 535 Incorrect authentication data (set_id=adriana)


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:02:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<BqF/qtBDUMmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-11-17 18:02:35 dovecot_login authenticator failed for (126.193.121.190.ispguatemala.com.gt) [190.121.193.126]:36684: 535 Incorrect authentication data (set_id=secretarioadjunto)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.57.221
country_id: 2017370
description:
2025-11-17 18:02:40 dovecot_login authenticator failed for (95x79x57x221.static-business.nn.ertelecom.ru) [95.79.57.221]:53864: 535 Incorrect authentication data (set_id=administrativo1@lorussoimoveis.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:03:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<9DE9rNBDPNmxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.203.210.119
country_id: 1269750
description:
2025-11-17 18:03:01 dovecot_login authenticator failed for (node103203210119.kkdbroadband.co.in) [103.203.210.119]:59264: 535 Incorrect authentication data (set_id=financeiro@radiosarabrasil.fm.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.135.117.245
country_id: 6252001
description:
2025-11-17 18:02:13 dovecot_login authenticator failed for 107-135-117-245.lightspeed.livnmi.sbcglobal.net [107.135.117.245]:32863: 535 Incorrect authentication data (set_id=secretarioadjunto@cieadep.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 191.177.160.64
country_id: 3469034
description:
[2025-11-17 18:02:31 -0300] info [webmaild] 191.177.160.64 - roseliaferreira@cauteseg.com.br "POST /cpsess5074341100/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2025-11-17 18:02:49 dovecot_login authenticator failed for ([186.5.178.229]) [186.5.178.229]:59661: 535 Incorrect authentication data (set_id=contato@brilhometal.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.78.131
country_id: 2077456
description:
2025-11-17 18:02:52 dovecot_login authenticator failed for ([123.209.78.131]) [123.209.78.131]:48164: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.61.238
country_id: 1814991
description:
2025-11-17 18:02:57 dovecot_login authenticator failed for ([111.26.61.237]) [111.26.61.238]:44784: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.28.86.1
country_id: 1819730
description:
2025-11-17 18:03:44 dovecot_login authenticator failed for (113-28-86-1.static.imsbiz.com) [113.28.86.1]:64707: 535 Incorrect authentication data (set_id=rafael@numesolucoes.com.br)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.104.76.94
country_id: 1835841
description:
2025-11-17 18:03:45 dovecot_login authenticator failed for ([222.104.76.94]) [222.104.76.94]:51382: 535 Incorrect authentication data (set_id=ti)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.169
country_id: 6252001
description:
2025-11-17 18:03:05 dovecot_login authenticator failed for (mobile-166-195-195-169.mycingular.net) [166.195.195.169]:44636: 535 Incorrect authentication data (set_id=administrativo1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-11-17 18:03:13 dovecot_login authenticator failed for ([94.131.211.168]) [94.131.211.168]:50216: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:03:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<ix4NrtBDWumxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.57.17.169
country_id: 1814991
description:
2025-11-17 18:03:45 dovecot_login authenticator failed for ([111.57.17.169]) [111.57.17.169]:51738: 535 Incorrect authentication data (set_id=financeiro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2025-11-17 18:03:48 dovecot_login authenticator failed for ([61.72.58.242]) [61.72.58.242]:43287: 535 Incorrect authentication data (set_id=isabellylisboa@seventreinamentos.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.210.33.193
country_id: 2233387
description:
Nov 17 18:04:02 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@ieq.com.br>, method=PLAIN, rip=165.210.33.193, lip=200.150.196.245, session=<qyyYr9BDlIyl0iHB>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2025-11-17 18:04:02 dovecot_login authenticator failed for ([183.171.53.82]) [183.171.53.82]:58910: 535 Incorrect authentication data (set_id=rafael)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.179.135.174
country_id: 2661886
description:
2025-11-17 18:03:06 dovecot_login authenticator failed for ([194.179.135.174]) [194.179.135.174]:40511: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.52.194
country_id: 1269750
description:
2025-11-17 18:03:14 dovecot_login authenticator failed for ([182.95.52.194]) [182.95.52.194]:59366: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.213.224.4
country_id: 6252001
description:
2025-11-17 18:03:33 dovecot_login authenticator failed for ([140.235.89.71]) [162.213.224.4]:52150: 535 Incorrect authentication data (set_id=ti@maringasoldas.com.br)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:04:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<EF+esdBDqJ+xV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
country_id: 1269750
description:
2025-11-17 18:04:53 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:53504: 535 Incorrect authentication data (set_id=design@inovasite.com)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 8.141.13.53
country_id: 1814991
description:
Nov 17 18:04:56 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<test@lixadorajl.com.br>, method=PLAIN, rip=8.141.13.53, lip=200.150.196.245, session=<BxzistBDNscIjQ01>


plugin: ossec
rule: 9709
name: Multiple Dovecot Aborted Logins with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:05:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<xYUxtdBDPryxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2025-11-17 18:05:44 dovecot_login authenticator failed for (nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:60618: 535 Incorrect authentication data (set_id=design)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:06:02 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<gVH5ttBDLNKxV3kv>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
country_id: 1814991
description:
2025-11-17 18:05:09 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:41808: 535 Incorrect authentication data (set_id=contato@rreguimaraes.com.br)


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 36.50.176.110
country_id: 1562822
description:
Nov 17 18:05:15 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<no-reply@lixadoracuritiba.com.br>, method=PLAIN, rip=36.50.176.110, lip=200.150.196.245, session=<czsMtNBD5M4kMrBu>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.228.134
country_id: 1269750
description:
2025-11-17 18:05:24 dovecot_login authenticator failed for (nsg-static-209.69.76.182-airtel.com) [128.185.228.134]:46612: 535 Incorrect authentication data (set_id=contato)


plugin: ossec
rule: 5403
name: First time user executed sudo.
description:
Nov 17 18:06:34 hosting sudo: wp-toolkit : TTY=unknown ; PWD=/usr/local/cpanel/3rdparty/wp-toolkit/scripts ; USER=radio107 ; COMMAND=/bin/test -e /home/radio107/wordpress-backups


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 210.114.18.108
country_id: 1835841
description:
Nov 17 18:06:16 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<support@ieq.com.br>, method=PLAIN, rip=210.114.18.108, lip=200.150.196.245, session=<XC+wt9BDEsPSchJs>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:06:32 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<CCLKuNBDwt6xV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 165.211.25.202
country_id: 2233387
description:
Nov 17 18:06:32 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<admin@huboperacoes.com>, method=PLAIN, rip=165.211.25.202, lip=200.150.196.245, session=<CWKkuNBDmIql0xnK>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
country_id: 1814991
description:
2025-11-17 18:06:42 dovecot_login authenticator failed for ([61.150.123.106]) [61.150.123.106]:38667: 535 Incorrect authentication data (set_id=atualizacoes@inovasite.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.142.25.183
country_id: 298795
description:
2025-11-17 18:06:55 dovecot_login authenticator failed for (host-195-142-25-183.reverse.superonline.net) [195.142.25.183]:45110: 535 Incorrect authentication data (set_id=atualizacoes)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 194.164.107.5
country_id: 6252001
description:
Nov 17 18:07:59 hosting dovecot: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 2 secs): user=<>, rip=194.164.107.5, lip=191.243.196.56, TLS, session=<5XXxvdBDNuvCpGsF>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 103.244.206.6
country_id: 1643084
description:
Nov 17 18:08:03 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@ufadville.com.br>, method=PLAIN, rip=103.244.206.6, lip=200.150.196.245, session=<nNYGvtBDYsFn9M4G>


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 177.87.121.47
country_id: 3469034
description:
Nov 17 18:07:33 hosting dovecot: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 1 secs): user=<>, rip=177.87.121.47, lip=200.150.196.245, session=<K29hvNBDMJCxV3kv>


plugin: ossec
rule: 9710
name: Dovecot Auth failed on disconnected session.
abuser: 64.227.136.122
country_id: 1269750
description:
Nov 17 18:07:34 hosting dovecot: pop3-login: Disconnected: Connection closed (user disabled): user=<sales@implementarconsultoria.com.br>, method=PLAIN, rip=64.227.136.122, lip=200.150.196.245, session=<EjZavNBDvrtA44h6>


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.111.249.76
country_id: 2017370
description:
2025-11-17 18:07:41 dovecot_login authenticator failed for (pppoe-78-111-249-76.dynamic.tvingo.ru) [78.111.249.76]:47877: 535 Incorrect authentication data (set_id=financeiro@louvoreterno.com.br)


