Been getting quite a bit of this in the 'secure' log within the last few days.

Nov 28 07:29:22 lydgate xinetd[7641]: START: imap pid=24240 from=217.35.91.223
Nov 28 07:29:22 lydgate xinetd[7641]: EXIT: imap pid=24240 duration=0(sec)
Nov 28 15:48:45 lydgate xinetd[7641]: START: imap pid=24599 from=81.174.141.187
Nov 28 15:48:45 lydgate xinetd[7641]: EXIT: imap pid=24599 duration=0(sec)
Nov 29 01:42:18 lydgate xinetd[7641]: START: imap pid=25123 from=212.19.61.210
Nov 29 01:42:21 lydgate xinetd[7641]: EXIT: imap pid=25123 duration=3(sec)

I've found http://www.cotse.com/sw/portscan/imapd_scan.sh but AFAIK this an old thing

Is there a new imap scanning tool doing the rounds?

Steve