This email gets generated after successful login on smtp channel, so if it does not match your ip address / country it is likely the account is compromised yes. Definitely get the user to change their password.

Having just glanced through the source code, normally a successful login via pop / imap / surgeweb will add the ip address to the known safe ip address list.  (unless you have "g_safe_imap" set as well) So for your other user, provided the ip address matches your current address I believe this is likely to just mean the ip has changed and an smtp send is getting attempted before the mail fetching login.

Let us know if you have more issues with this feature.

Marijn

 

On Friday 31/01/2014 at 5:59 am, Martin Abell wrote:

We are asked about messages like the one below all the time.  In this case, the IP appears to be in Italy, and the user is not, so I recommended she change the password.  But truthfully, not certain when this message is generated.  Is it when someone actually has guessed the correct password (as the message sort of implies) ?  Or have there just been some guesses from that IP?  Because if it's the latter, I wouldn't tell someone to change a really good password to another password.  Weak one, yes.

Somewhat related: if you take your laptop to a new country and try to login and you are asked to enter your password, is that because the server doesn't recognize your IP address?  We have a customer who says he is constantly thwarted on login from a new location until he goes into Outlook settings and runs "Test account settings."  The reason for that is difficult for us to understand (although we don't use Outlook - and, unfortunately, don't often hit exotic locales).

Any enlightenment appreciated.

Martin and Larry

SpeedSpan.

========================================

From: Mail System [mailto:mailadmin@xxxxxx.com]
Sent: Friday, November 01, 2013 11:43 PM
To: dwhxxxxxx.comSubject: SMTP send from new address blocked

Important report from SurgeMail sp40.spanmail.net host=sp40.spanmail.net -
see details below

Sorry logins are not permitted from unknown ip addresses.  Please use this
url to enable SMTP sending for the new ip address If you were not sending
from this address then change your password immediately!

Login from unknown address (g_safe_smtp) (91.81.108.166)
user=dwhxxxxxx@xxxxxx.com open this link in browser to enable loginshttps://mail.xxxxxx.com:7454/vfy?f=55d937c2

dfdkl