How to handle abnormal login to the mail server from an overseas IP and abnormal email sending?

Customers often report that their mailbox has been logged in abnormally from overseas IP addresses, and that emails have been sent out through overseas IP addresses. How can this be resolved?

If it is confirmed through login logs or outgoing mail logs that there have been logins from overseas IP addresses or that emails have been sent, and the customer also confirms that they did not perform these operations, then it can be determined that the password has been leaked.

1. First, check the cause of the password leak. For example, check whether you previously received a phishing email sent by a hacker and entered your mailbox account and password on a website provided by the hacker. Next, run a full virus scan on the user's computer,

and configure the necessary security settings (install antivirus software, do not click unknown links, do not install unknown software, do not enter your account and password on any website or address, etc.).

2. You must change the current mailbox account password again, make the password as complex as possible, do not save it on the computer, and prevent it from being leaked again as much as possible.

3. Log in to the mailbox via the web, click Settings > Account Security and enable Block Overseas Login. In addition, “Client Independent Password” and “Client IP Restriction” can also be enabled or disabled according to the actual situation.

Note: After “Block Overseas Login” is enabled, it applies to the web version of the mailbox, 全球云邮 mini program, and email client software. This means that after it is enabled, whether you log in via the web, the mini program, or email client software, you will not be able to log in from overseas, which greatly improves security.