Skip to content

Brevo

Service Name: Brevo

Service Description: Brevo (formerly Sendinblue) is an all-in-one digital marketing platform that offers email marketing, SMS marketing, chat, CRM, and marketing automation tools for businesses of all sizes.

Service Address: https://www.brevo.com/

Validation Type: -

IP Allow list: Does not exist

Secret Access Scope: Grants access to Brevo's API for managing email campaigns, contacts, transactional emails, SMS, and other marketing automation features.

Secret Revokement URL: https://app.brevo.com/settings/keys/api

Secret Example: xkeysib-0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789ab-ABCdefGHI

Suspicious Activity Investigation Instructions:

  • Check Brevo dashboard for unauthorized email campaigns or contact list modifications.
  • Review API logs for unusual API calls or high volume of requests.
  • Monitor for unexpected changes in contact lists or template modifications.
  • Check for unusual sending patterns or spikes in email/SMS volume.
  • Review account settings for unauthorized changes to webhooks or integrations.

Mitigation Instructions:

  • Sign in to your Brevo account at app.brevo.com.
  • Go to Settings > API Keys & SMTP.
  • Locate the compromised API key and select Delete.
  • Generate a new API key if needed.
  • Update the API key in all legitimate applications.
  • Review and update IP whitelisting if enabled.
  • Enable two-factor authentication for your Brevo account.