<0>e.g. accounts that have been phished (e.g. the user provided their username/password to an attacker), the user had weak or re-used passwords or credentials were obtained via a compromised device.<1>Remediation: use rate-limiting to help identify the compromised account(s) look for messages being sent with Reply-To: headers or messages containing blocklisted domains. You can also use an authentication blocklist to identify the compromised accounts by reporting log-in attempts from listed hosts where the IP accessing the account has been seen using other compromised accounts.<2>IMPORTANT: Once the compromised account has been identified, the password should be changed immediately to something secure and any queued mail from the account should be removed (as there could be a considerable amount) prior to submitting a delist request to prevent the IP from being quickly relisted.<3>Mitigation: User training; don't give out passwords or use the same password on multiple different sites - use a password manager instead. An authentication blocklist can prevent login or identify logins from compromised hosts that we've observed abusing other accounts in the same way.

Welcome to Abusix