Imap Command Authenticate

Matches the IMAP AUTHENTICATE command issued by a client to initiate SASL-based authentication. This command begins an authentication exchange using a specified mechanism (e.g., PLAIN, LOGIN, CRAM-MD5, XOAUTH2) prior to mailbox access.

Observed IPs

Avg Confidence

89%

Protocol

IMAP

Top IPs by event count

IP Address	Risk	Events	Sessions	Country	ASN	Last Seen
62.171.129.237	99%	68,798	27,493	🇩🇪 DE	AS51167	2026-04-03
161.97.132.79	98%	68,523	27,494	🇫🇷 FR	AS51167	2026-04-03
152.32.243.98	91%	1,635	689	🇰🇷 KR	AS135377	2026-03-28
165.154.49.137	94%	1,542	429	🇮🇩 ID	AS135377	2026-04-03
107.150.117.219	94%	1,319	506	🇩🇪 DE	AS135377	2026-03-25
123.58.196.49	98%	1,316	545	🇹🇼 TW	AS135377	2026-04-05
128.14.225.253	97%	1,310	522	🇺🇸 US	AS135377	2026-04-05
118.194.249.72	99%	1,286	633	🇰🇷 KR	AS135377	2026-04-05
165.154.36.245	90%	1,250	624	🇺🇸 US	AS135377	2026-03-23
101.36.114.252	98%	1,169	539	🇰🇷 KR	AS135377	2026-04-05
101.36.97.70	94%	1,164	551	🇬🇧 GB	AS135377	2026-04-05
118.193.61.179	95%	1,116	574	🇯🇵 JP	AS135377	2026-04-06
152.32.151.39	98%	1,098	446	🇺🇸 US	AS135377	2026-03-31
165.154.138.151	92%	1,079	553	🇩🇪 DE	AS135377	2026-03-29
128.14.237.43	91%	1,066	393	🇺🇸 US	AS135377	2026-04-05
165.154.218.158	95%	1,016	504	🇺🇸 US	AS135377	2026-04-05
118.194.234.14	98%	1,010	476	🇸🇬 SG	AS135377	2026-04-06
123.58.210.106	88%	989	465	🇭🇰 HK	AS135377	2026-04-05
128.14.226.191	94%	976	384	🇺🇸 US	AS135377	2026-04-02
118.194.228.239	96%	974	443	🇯🇵 JP	AS135377	2026-03-28