Dec 19 19:38:28 userdomain spamd[12632]: spamd: connection from ::1 [::1]:60984 to port 783, fd 5
Dec 19 19:38:28 userdomain spamd[3308]: prefork: child states: I
Dec 19 19:38:28 userdomain dovecot: pop3-login: Aborted login (no auth attempts in 0 secs): user=<>, rip=127.0.0.1, lip=127.0.0.1, secured, session=<5imEKGV9/K5/AAAB>
Dec 19 19:38:28 userdomain dovecot: lmtp(14486): Connect from local
Dec 19 19:38:28 userdomain dovecot: lmtp(14486): Disconnect from local: Successful quit
Dec 19 19:38:29 userdomain dovecot: imap-login: Login: user=<__cpanel__service__auth__imap__l7vhbiwwcdfytpplo_gp9780bbrfaz5ppdag5msvgjsmne...>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=14499, secured, session=<Z9yLKGV9zt5/AAAB>
Dec 19 19:38:29 userdomain dovecot: imap(__cpanel__service__auth__imap__l7vhbiwwcdfytpplo_gp9780bbrfaz5ppdag5msvgjsmneolhshlbj5tiydytic2): Logged out in=11, out=476, bytes=11/476
Dec 19 19:39:02 userdomain dovecot: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<usera@userdomain.com>, method=PLAIN, rip=xxx.xxx.67.84, lip=xxx.xxx.163.125, TLS: Disconnected, session=<ye1oKmV9ylyx5ENU>
Dec 19 19:39:08 userdomain dovecot: imap-login: Disconnected (auth failed, 1 attempts in 6 secs): user=<usera@userdomain.com>, method=PLAIN, rip=xxx.xxx.67.84, lip=xxx.xxx.163.125, TLS: Disconnected, session=<B9GPKmV95Vex5ENU>
Dec 19 19:39:38 userdomain dovecot: imap-login: Disconnected (auth failed, 1 attempts in 2 secs): user=<userb@userdomain.com>, method=PLAIN, rip=xxx.xxx.67.84, lip=xxx.xxx.163.125, TLS: Disconnected, session=<6N+ULGV9YNCx5ENU>
Dec 19 19:39:48 userdomain dovecot: imap-login: Disconnected (auth failed, 3 attempts in 15 secs): user=<userc@userdomain.com>, method=PLAIN, rip=xxx.xxx.141.140, lip=xxx.xxx.163.125, TLS, session=<T6drLGV9f829rY2M>
Dec 19 19:40:20 userdomain dovecot: imap-login: Disconnected (auth failed, 3 attempts in 16 secs): user=<userd@userdomain.com>, method=PLAIN, rip=xxx.xxx.141.140, lip=xxx.xxx.163.125, TLS, session=<Qco2LmV9jM29rY2M>
Dec 19 19:40:23 userdomain dovecot: imap-login: Disconnected (auth failed, 3 attempts in 15 secs): user=<usere@userdomain.com>, method=PLAIN, rip=xxx.xxx.67.84, lip=xxx.xxx.163.125, TLS, session=<IWB7LmV9ffax5ENU>
Dec 19 19:40:23 userdomain dovecot: imap-login: Disconnected (no auth attempts in 75 secs): user=<>, rip=xxx.xxx.67.84, lip=xxx.xxx.163.125, TLS handshaking: SSL_accept() syscall failed: Connection reset by peer, session=<sPNdL2V9F6Wx5ENU>