May 27 14:45:15 server dovecot[5350]: pop3-login: Disconnected: rip=85.234.152.91, lip=xxx.xxx.xxx.xxx
May 27 14:45:20 server spamd[5076]: spamd: connection from localhost.localdomain [127.0.0.1] at port 46993
May 27 14:45:20 server spamd[5076]: spamd: setuid to user succeeded
May 27 14:45:20 server spamd[5076]: spamd: processing message <01c8c025$6d4aca00$2606443a@dfc> for user:507
May 27 14:45:20 server spamd[5076]: spamd: identified spam (13.3/5.0) for user:507 in 0.3 seconds, 963 bytes.
May 27 14:45:20 server spamd[5076]: spamd: result: Y 13 - FAKE_REPLY_C,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_PBL,RCVD_IN_XBL,URIBL_RHS_DOB,URIBL_SC_SURBL,URIBL_WS_SURBL scantime=0.3,size=963,user=user,uid=507,required_score=5.0,rhost=localhost.localdomain,raddr=127.0.0.1,rport=46993,mid=<01c8c025$6d4aca00$2606443a@dfc>,autolearn=spam
May 27 14:45:20 server spamd[4937]: prefork: child states: II
May 27 14:45:26 server dovecot[5350]: pop3-login: Login: user=<user>, method=PLAIN, rip=212.61.100.254, lip=xxx.xxx.xxx.xxx
May 27 14:45:26 server dovecot[5350]: POP3(user): Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0
May 27 14:45:27 server dovecot[5350]: pop3-login: Login: user=<systeem>, method=PLAIN, rip=212.61.100.254, lip=xxx.xxx.xxx.xxx
May 27 14:45:27 server dovecot[5350]: POP3(systeem): Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0
May 27 14:45:27 server dovecot[5350]: auth(default): shadow([email protected],212.61.100.254): unknown user
May 27 14:45:27 server dovecot[5350]: auth(default): passwd([email protected],212.61.100.254): unknown user
May 27 14:45:27 server dovecot[5350]: pop3-login: Login: user=<[email protected]>, method=PLAIN, rip=212.61.100.254, lip=xxx.xxx.xxx.xxx
May 27 14:45:28 server dovecot[5350]: POP3([email protected]): Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0