98.97.131.208

98.97.131.208 (BR/Brazil/customer.brsabra1.isp.starlink.com), 10 distributed imapd attacks on account [REDACTED] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Oct 27 04:45:23 dovecot[761]: imap-login: Login aborted: ... show more 98.97.131.208 (BR/Brazil/customer.brsabra1.isp.starlink.com), 10 distributed imapd attacks on account [REDACTED] in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_DISTATTACK; Logs: Oct 27 04:45:23 dovecot[761]: imap-login: Login aborted: Connection closed (auth failed, 1 attempts in 2 secs) (auth_failed): user=[USERNAME] method=PLAIN, rip=89.111.203.158, lip=0.0.0.x, TLS, session=<aauORspelsRZb8ue> Oct 27 04:43:15 dovecot[761]: imap-login: Login aborted: Connection closed (auth failed, 1 attempts in 3 secs) (auth_failed): user=[USERNAME] method=PLAIN, rip=98.97.131.208, lip=0.0.0.x, TLS, session=<kGq9Pspe09BiYYPQ> Oct 27 04:45:20 dovecot[761]: imap-login: Login aborted: Co show less

denied traffic to a honeypot network. destination port 28696.

Web bot: denial-of-service flood

Suspicious WooCommerce query combination detected. Not default available on websites. Matched combi patterns: filter_, add-to-cart=, orderby=, product_count=. Activity is consistent with high-volume request abuse.