grep 'auth failed.*IP_ADDRESS' /var/log/maillog
Example:
grep 'auth failed.*46.100.58.158' /var/log/maillog
Sample Output:
Sep 29 10:18:29 de1 dovecot: pop3-login: Disconnected (auth failed, 2 attempts in 11 secs): user=info@yourdomain.ext, method=PLAIN, rip=46.100.58.158, lip=95.217.198.13, session= Sep 29 10:18:47 de1 dovecot: pop3-login: Disconnected (auth failed, 2 attempts in 19 secs): user=info@yourdomain.ext, method=PLAIN, rip=46.100.58.158, lip=95.217.198.13, session= Sep 29 10:19:35 de1 dovecot: pop3-login: Disconnected (auth failed, 2 attempts in 18 secs): user=info@yourdomain.ext, method=PLAIN, rip=46.100.58.158, lip=95.217.198.13, session=