==== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.7
- Linux/BSD distribution name and version: debian 8
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): ldap
- Web server (Apache or Nginx):apache
- Manage mail accounts with iRedAdmin-Pro?no
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====
Hi all,
I have execute this script to find top ip address for user connexion: here is the result:
./find_sasl_login_ip.sh /var/log/mail.log user1

      1 client=f497.i.mail.ru[217.69.138.164],
      1 client=f498.i.mail.ru[217.69.138.165],
      1 client=f506.i.mail.ru[217.69.138.173],
      1 client=f508.i.mail.ru[217.69.138.175],
      1 client=f511.i.mail.ru[217.69.138.178],
      1 client=f512.i.mail.ru[217.69.138.179],
      1 client=f67.i.mail.ru[94.100.185.144],
      2 client=f431.i.mail.ru[185.5.136.102],
      2 client=localhost[127.0.0.1],

Is this  count user hacked??
Thank's for help