LeakySensey: Stolen proxy API key reuse from multiple atypical source IPs
Detects instances where a single proxy service API key or account is used from an abnormally high number of distinct IP addresses within a short timeframe. This behavior is indicative of credential theft and unauthorized sharing or exploitation of proxy credentials by third-party actors.
Microsoft Sentinel (KQL)

