Re: IMAP connections with ".eml" in the username - bot attack.

2017-11-13 Thread Joseph Tam
James Brown writes: We are seeing lots of IMAP login attempts like this: dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=197.255.60.118, dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=

Re: IMAP connections with ".eml" in the username - bot attack.

2017-11-12 Thread Sean Greenslade
On Mon, Nov 13, 2017 at 02:47:00PM +1100, James Brown wrote: > We are seeing lots of IMAP login attempts like this: > > dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): > user=, > method=PLAIN, rip=197.255.60.118, > > or > > dovecot[363]: imap-login: Disconnected (au

Re: IMAP connections with ".eml" in the username - bot attack.

2017-11-12 Thread Sami Ketola
> On 13 Nov 2017, at 8.21, Sami Ketola wrote: > >> >> On 13 Nov 2017, at 5.47, James Brown wrote: >> >> We are seeing lots of IMAP login attempts like this: >> >> dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): >> user=, >> method=PLAIN, rip=197.255.60.118, >>

Re: IMAP connections with ".eml" in the username - bot attack.

2017-11-12 Thread Sami Ketola
> On 13 Nov 2017, at 5.47, James Brown wrote: > > We are seeing lots of IMAP login attempts like this: > > dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): > user=, > method=PLAIN, rip=197.255.60.118, > > or > > dovecot[363]: imap-login: Disconnected (auth failed,

IMAP connections with ".eml" in the username - bot attack.

2017-11-12 Thread James Brown
We are seeing lots of IMAP login attempts like this: dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=197.255.60.118, or dovecot[363]: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=, method=PLAIN, rip=37.235.28.229, e