DocsAttack Types

Web & Application Abuse

Automated web traffic: floods, scraping, enumeration and login abuse.

A VM floods or abuses websites: request floods, aggressive scraping, account enumeration or login abuse. Frabs counts HTTPS requests and the patterns behind them per VM.

Detectors (8)

Detector	Measures	Warning	Incident	Critical
Credential Stuffing	Short connections to authentication ports (attempts)	100 in 5 min	500 in 10 min	2,000 in 30 min
HTTPS Request Flood	Outbound TLS connections per second to web ports (443, 8443) (conn/s)	500 in 30 s	2,000 in 30 s	5,000 in 30 s
Aggressive Crawling	Distinct targets on the service's ports (targets)	100 in 5 min	1,000 in 10 min	5,000 in 30 min
Web Application Scanning	Distinct targets on the service's ports (targets)	50 in 10 min	250 in 30 min	1,000 in 1 h
CMS Scanning	Distinct targets on the service's ports (targets)	50 in 10 min	250 in 30 min	1,000 in 1 h
WordPress Scanning	Distinct targets on the service's ports (targets)	50 in 10 min	250 in 30 min	1,000 in 1 h
Login Brute Force	Short connections to authentication ports (attempts)	100 in 5 min	500 in 10 min	2,000 in 30 min
Web Vulnerability Probing	Distinct targets on the service's ports (targets)	50 in 10 min	250 in 30 min	1,000 in 1 h

Change the thresholds

Use Custom Protection to change any of these, or set them for one VM. See Detectors and Thresholds.

PreviousProxy, Relay & Anonymisation NextRemote-Service Abuse