DocsAttack Types

Spam & Email Abuse

Unusual volumes or patterns of outbound mail.

A VM sends unusual volumes of mail or talks to many mail servers at once. Spam is the fastest way to get IP ranges blocklisted. Frabs counts outbound SMTP sessions and the mail servers each VM reaches.

Detectors (9)

Detector	Measures	Warning	Incident	Critical
SMTP Spam	SMTP sessions to distinct mail servers (sessions)	500 in 1 h	2,000 in 1 h	5,000 in 1 h
Bulk SMTP	Outbound SMTP connections (25, 465, 587) (connections)	100 in 1 h	500 in 1 h	1,000 in 1 h
Mass Email Sending	SMTP sessions to distinct mail servers (sessions)	500 in 1 h	2,000 in 1 h	5,000 in 1 h
SMTP Connection Flood	New outbound connections per second (conn/s)	20 in 1 min	100 in 1 min	500 in 1 min
Spam Campaign Activity	SMTP sessions to distinct mail servers (sessions)	500 in 1 h	2,000 in 1 h	5,000 in 1 h
Phishing Email Distribution	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Malware Email Distribution	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
High-Volume Outbound Email	Outbound SMTP connections (25, 465, 587) (connections)	100 in 1 h	500 in 1 h	1,000 in 1 h
SMTP Reputation Abuse	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h

Change the thresholds

Use Custom Protection to change any of these, or set them for one VM. See Detectors and Thresholds.

PreviousMalicious Payload Distribution NextDNS Abuse