DocsAttack Types

Proxy, Relay & Anonymisation

A VM relaying other people's traffic.

A VM relays other people's traffic as an open proxy or relay, so attacks and spam appear to come from your network. Frabs looks for one VM carrying many unrelated clients to many unrelated destinations.

Detectors (3)

Detector	Measures	Warning	Incident	Critical
Proxy Pool Behaviour	Distinct destination addresses (addresses)	50 in 1 h	100 in 1 h	500 in 1 h
Tor Relay Traffic	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Tor Exit Traffic	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h

Change the thresholds

Use Custom Protection to change any of these, or set them for one VM. See Detectors and Thresholds.

PreviousDNS Abuse NextWeb & Application Abuse