Fabian,

Thanks for the suggestions.

> Please help. Thanks.

Check out all your log files for the mention IP address. Even
e.g. the Apache logs for all websites. Probably this IP address
was just causing some "overload" on your server, but did not try
to brute force any user accounts. So there was no reason for
fail2ban to ban anything. Just find out what was going on and
then decide what to do, e.g. tuning your server or eventually
creating a custom filter and jail for this, if it does abuse your
system.

I did a grep in /var/log and found occurrences in the following files. (I got hundreds of lines, but showing just a few lines here.).
What is your suggestion on the lines in dovecot.log ?

root@Server:/var/log# grep -r -s "199.255.213.186" *

=========================================
debug.1:Jul  1 21:11:36 mx kernel: [3820161.960380] TCP: drop open request from 199.255.213.186/61263
debug.1:Jul  1 21:11:36 mx kernel: [3820162.200371] TCP: drop open request from 199.255.213.186/61780
debug.1:Jul  1 21:11:39 mx kernel: [3820165.204753] TCP: drop open request from 199.255.213.186/61780
debug.1:Jul  1 21:11:40 mx kernel: [3820166.239894] TCP: drop open request from 199.255.213.186/62034
debug.1:Jul  1 21:11:42 mx kernel: [3820167.979885] TCP: drop open request from 199.255.213.186/62118
debug.1:Jul  1 21:11:56 mx kernel: [3820182.026705] TCP: drop open request from 199.255.213.186/62400
debug.1:Jul  1 21:11:56 mx kernel: [3820182.392301] TCP: drop open request from 199.255.213.186/62924
debug.1:Jul  1 21:11:57 mx kernel: [3820183.674660] TCP: drop open request from 199.255.213.186/62507
=========================================

dovecot.log:Jul 01 20:37:45 pop3-login: Info: Aborted login (no auth attempts): rip=199.255.213.186, lip=100.101.1.2
dovecot.log:Jul 01 20:37:45 pop3-login: Info: Aborted login (no auth attempts): rip=199.255.213.186, lip=100.101.1.2
dovecot.log:Jul 01 20:37:46 pop3-login: Info: Aborted login (no auth attempts): rip=199.255.213.186, lip=100.101.1.2
dovecot.log:Jul 01 20:37:56 pop3-login: Info: Aborted login (tried to use disabled plaintext auth): rip=199.255.213.186, lip=100.101.1.2
dovecot.log:Jul 01 20:37:57 pop3-login: Info: Aborted login (tried to use disabled plaintext auth): rip=199.255.213.186, lip=100.101.1.2
dovecot.log:Jul 01 20:37:57 pop3-login: Info: Aborted login (tried to use disabled plaintext auth): rip=199.255.213.186, lip=100.101.1.2
dovecot.log:Jul 01 20:37:57 pop3-login: Info: Aborted login (tried to use disabled plaintext auth): rip=199.255.213.186, lip=100.101.1.2
dovecot.log:Jul 01 20:38:37 pop3-login: Info: Disconnected (no auth attempts): rip=199.255.213.186, lip=100.101.1.2
dovecot.log:Jul 01 20:39:00 pop3-login: Info: Aborted login (no auth attempts): rip=199.255.213.186, lip=100.101.1.2
dovecot.log:Jul 01 20:39:01 pop3-login: Info: Aborted login (no auth attempts): rip=199.255.213.186, lip=100.101.1.2
dovecot.log:Jul 01 20:39:01 pop3-login: Info: Disconnected (tried to use disabled plaintext auth): rip=199.255.213.186, lip=100.101.1.2
====================================================

kern.log.1:Jul  1 20:40:22 mx kernel: [3818287.949687] TCP: drop open request from 199.255.213.186/51308
kern.log.1:Jul  1 20:40:22 mx kernel: [3818288.001514] TCP: drop open request from 199.255.213.186/50741
kern.log.1:Jul  1 20:40:22 mx kernel: [3818288.124865] TCP: drop open request from 199.255.213.186/51123
kern.log.1:Jul  1 20:40:22 mx kernel: [3818288.199427] TCP: drop open request from 199.255.213.186/50749
kern.log.1:Jul  1 20:40:22 mx kernel: [3818288.299990] TCP: drop open request from 199.255.213.186/51132
kern.log.1:Jul  1 20:40:22 mx kernel: [3818288.341406] TCP: drop open request from 199.255.213.186/51131
kern.log.1:Jul  1 20:40:27 mx kernel: [3818293.090121] TCP: drop open request from 199.255.213.186/51654
kern.log.1:Jul  1 20:40:27 mx kernel: [3818293.104811] TCP: drop open request from 199.255.213.186/51657
kern.log.1:Jul  1 20:40:27 mx kernel: [3818293.170822] TCP: drop open request from 199.255.213.186/51662