Network Abuse
Stop abuse leaving your network
A sensor on each node. Your rules in the panel.
01 · Install
One command. You confirm the rest.
Installed from the panel, as root on the node
✓ Proxmox VE 8.2 · 14 VPS interfaces · 2 bridges
Waiting for you to confirm in the panel…
What Frabs Watches
- Nothing runs until you confirm
- No software inside customer VPSes
- Outbound-only connection to Frabs
02 · Detect
Evidence, not thresholds
A busy node and an attacking one can send the same amount of traffic. Frabs looks at what the traffic is, not only how much.
01
Measure
Every VPS's traffic in both directions: what it sends, and what comes back.
02
Weigh
Evidence for an attack and evidence against it. What Frabs cannot see counts as neither.
03
Confirm
Each attack type has a signature it must show. A short burst never counts.
04
Score
One score per incident, from 0 to 100: Low, Medium, High or Critical.
How Frabs Tells Them Apart
Game Server vs Flood
Game servers get replies. Floods don't.
Web Crawler vs Web Scan
Crawlers reach real sites. Scans hit empty addresses.
Mail Relay vs Spam Run
One relay, or thousands of mail servers.
Update Checks vs Botnet Check-ins
Shared destinations are never a botnet's.
BitTorrent vs Port Scan
Many peers, or many ports on one host.
Backups vs Data Theft
Large uploads are reported, never acted on alone.
An Incident's Evidence
- Every score shows the evidence behind it
- Weak findings stay on the node, never in your incident list
- Detection keeps running if the connection to Frabs drops
20 Attack Types
- DDoS & Flooding
- Reflection & Amplification
- Port Scanning
- Host & Network Discovery
- Vulnerability & Exploit Scanning
- Brute Force & Credential Attacks
- Malware & Command-and-Control
- Malicious Payload Distribution
03 · Attribute
Every attack has a name
From the interface on the node to the service in your billing system.
Interface
tap101i0
lon-pve-01 · 203.0.113.10
VPS
web-01
Proxmox VMID 101
Customer
Halden Digital
WHMCS service 5200
04 · Act
Your rules for each level
You choose what happens at Low, Medium, High and Critical. Frabs only acts when the evidence is strong enough for that action.
- Limits only on High or Critical evidence
- Isolation and suspension only when you add them
- Timed actions lift themselves
- Every action is recorded with its reason
05 · Prove
Reports in your brand
Every attack report carries your logo, your colours and your company name. Frabs never appears on them, so customers see a report from you.
In every report
Safety
Built to fail safe
Fail-open
If a sensor stops, your network carries on.
Emergency controls
Switch enforcement off everywhere at once.
You stay in charge
Isolation and suspension run only if you add them to your rules.
Full audit log
Every action, who took it and when.
Outbound only
Nodes connect out to Frabs. Nothing connects in.
Alerts that matter
Routed by severity to the right people.