Displaying 1 result from an estimated 1 matches for "1174402".
Did you mean:
1174302
2017 Nov 13
3
IMAP connections with ".eml" in the username - bot attack.
We are seeing lots of IMAP login attempts like this:
dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=<xcentrex5fxnewx5fxyorkx5fxquotex5fxisx5fxreadyx2dxx2dx426453.eml>, method=PLAIN, rip=197.255.60.118,
or
dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=<xmatchingx5fxyourx5fxrecentx5fxvisitx5fxonx5fxx2dxx2dx121584.eml at