diff --git a/filters/dovecot.preg b/filters/dovecot.preg
new file mode 100644
index 0000000..9b449b4
--- /dev/null
+++ b/filters/dovecot.preg
@@ -0,0 +1,2 @@
+pop3-login: Disconnected \(auth failed, [0-9]+ attempts in [0-9]+ secs\): .* rip=<HOST>
+imap-login: Disconnected \(auth failed, [0-9]+ attempts in [0-9]+ secs\): .* rip=<HOST>