Imap Command Authenticate

Matches the IMAP AUTHENTICATE command issued by a client to initiate SASL-based authentication. This command begins an authentication exchange using a specified mechanism (e.g., PLAIN, LOGIN, CRAM-MD5, XOAUTH2) prior to mailbox access.

Observed IPs

Avg Confidence

93%

Protocol

IMAP

Top IPs by event count

IP Address	Risk	Events	Sessions	Country	ASN	Last Seen
62.171.129.237	99%	68,798	27,493	🇩🇪 DE	AS51167	2026-04-03
161.97.132.79	98%	68,523	27,494	🇫🇷 FR	AS51167	2026-04-03
152.32.243.98	91%	1,710	764	🇰🇷 KR	AS135377	2026-04-24
165.154.49.137	97%	1,605	492	🇮🇩 ID	AS135377	2026-04-27
123.58.196.49	99%	1,544	773	🇹🇼 TW	AS135377	2026-04-27
128.14.225.253	99%	1,529	741	🇺🇸 US	AS135377	2026-04-26
118.194.249.72	100%	1,465	812	🇰🇷 KR	AS135377	2026-04-27
107.150.117.219	98%	1,444	631	🇩🇪 DE	AS135377	2026-04-27
101.36.114.252	99%	1,400	770	🇰🇷 KR	AS135377	2026-04-27
165.154.36.245	94%	1,332	706	🇺🇸 US	AS135377	2026-04-25
101.36.97.70	99%	1,323	710	🇬🇧 GB	AS135377	2026-04-27
152.32.151.39	100%	1,278	618	🇺🇸 US	AS135377	2026-04-28
128.14.237.43	99%	1,273	600	🇺🇸 US	AS135377	2026-04-27
118.193.61.179	99%	1,229	687	🇯🇵 JP	AS135377	2026-04-22
165.154.218.158	99%	1,223	711	🇺🇸 US	AS135377	2026-04-27
118.194.234.14	99%	1,161	627	🇸🇬 SG	AS135377	2026-04-28
123.58.210.106	98%	1,152	628	🇭🇰 HK	AS135377	2026-04-28
165.154.138.151	94%	1,116	590	🇩🇪 DE	AS135377	2026-04-21
118.194.228.239	99%	1,115	584	🇯🇵 JP	AS135377	2026-04-26
118.26.37.105	99%	1,114	614	🇭🇰 HK	AS135377	2026-04-27