50053 Compromised or not compromised?

[ArcticG]

Hi All,

In the signin logs I see 2 descriptions with id 50053:

• Sign-in was blocked because it came from an IP address with malicious activity
• Account is locked because user tried to sign in too many times with an incorrect user ID or password

The account blocked one seems like the account isn't compromised, but the Sign-in blocked seems like the account is compromised.

Can anyone 

[#2]

The sign-in part would tell me that the sign-in was stopped because if was malicious, before the user could authenticate

In these cases, I prefer to reset the users password.
You can never be too sure