Sources for further reading:
grep "IMAP LOGIN failed" /var/log/mail.log | awk 'print $NF' | sort | uniq -c MailKeker.py
A good enumeration tool provides detailed logging. MailKeker.py typically outputs the SMTP response codes, allowing the user to differentiate between a "hard bounce" (invalid user) and a "soft bounce" (server error or greylisting). Sources for further reading: grep "IMAP LOGIN failed"
Signs of an active MailKeker.py attack: