POP3 login failed
advICE :Intrusions : 2001604

Summary

Multiple POP3 logon failures using bad user names and/or passwords.

Details

An intruder may be attempting to guess passwords by logging in repeatedly. You should ensure you have good passwords on all your remotely accessible services.

False Positives

Many software packages contain "user friendly" features that attempt multiple passwords. This can trigger false possitives. If you see this frequently, you can change the login.pop3.count threshold to a larger number.

parametric information victim The IP address of the system on which the login attempt occurred. login The login name attempted.

configuration for this item login.pop3.count 4 The number of failed logins to trigger this intrusion detection. login.pop3.interval 3600 The time interval (in seconds) over which the login failures are measured.

 
Version appeared: