diff --git a/filters/dovecot.preg b/filters/dovecot.preg
index bd9d9ff..0d0c71f 100644
--- a/filters/dovecot.preg
+++ b/filters/dovecot.preg
@@ -1,3 +1,5 @@
+pop3-login: Aborted login \(auth failed, [0-9]+ attempts in [0-9]+ secs\): .* rip=<HOST>
+imap-login: Aborted login \(auth failed, [0-9]+ attempts in [0-9]+ secs\): .* rip=<HOST>
 pop3-login: Disconnected \(auth failed, [0-9]+ attempts in [0-9]+ secs\): .* rip=<HOST>
 imap-login: Disconnected \(auth failed, [0-9]+ attempts in [0-9]+ secs\): .* rip=<HOST>
 # set: defscore=5