How does email abuse occur?
Email is the biggest gateway for cyberattacks. Cybercriminals use phishing campaigns, brute force attacks, or credential stuffing (the use of passwords from other data leaks) to gain access to legitimate email accounts. These are then used to spread spam or malware unnoticed. But how does such an attack occur?
Hacked user accounts
Weak or stolen access data are popular entry points for attackers. Attackers gain access to email accounts using phishing campaigns, brute force attacks, or credential stuffing (i.e. using passwords from other data leaks). These accounts are then used to spread spam or malware under a false name without being noticed.
Malware on end devices
Trojans, viruses, or worms can embed themselves in employee PCs and send emails from there. This malware can read passwords, hijack email clients, or spread itself via email. The nasty thing is that the malware uses your company’s trustworthy sender address.
Vulnerabilities in the IT infrastructure
Unpatched systems with known security gaps or unsecured web forms are potential gateways – and attackers scan the internet specifically for such vulnerabilities and exploit them.
Inexperienced employees
It doesn’t always have to be abuse: sometimes employees accidentally send emails to entire distribution lists. Sometimes newsletters are accidentally sent to far too many recipients. Human error can also lead to mass emailing.
What are the consequences of email abuse?
The consequences of this type of email abuse can be serious: sending a large number of emails can result in your domain or IP address being placed on blocklists and thus blocked. In addition, your reputation will suffer: major email providers such as Outlook will classify your domain as unreliable – which is difficult to reverse.
The result is blocked business communication, meaning that important emails to partners or customers do not arrive. In addition, solving the problem, including restoring your reputation and compensating for business losses, will incur high costs.
What is Flow Guard?
Flow Guard protects you from the risks mentioned above by monitoring your company’s outbound email traffic. Each user in NoSpamProxy is assigned individual quotas for sending emails. These quotas or thresholds determine how many emails a user is allowed to send within a certain period of time. If a threshold is exceeded, Flow Guard intervenes and blocks further sending.
Flow Guard therefore allows you to control the volume of outbound emails. This means that unwanted mass emails – whether generated by inexperienced users or triggered by malware – can be detected before they are sent, protecting the reputation of your domain.
How does Flow Guard work?
Flow Guard monitors how many emails each user sends in real time. This monitoring runs in the background without affecting normal email communication.
In NoSpamProxy Cloud, there are fixed thresholds, while in NoSpamProxy Server, the administrator configures the thresholds, of which there are two different types:
- Number of recipient addresses per hour
- Total number of recipient addresses per day
The thresholds can be set individually for each user or based on AD group memberships. After all, an employee in sales has different requirements than someone in accounting, and sending newsletters often requires very high thresholds.
If the threshold is exceeded, any further outgoing emails are rejected. Sending is stopped before any damage can be done.
What are the advantages of Flow Guard?
In addition to the protection offered by malware scanners or 32Guards, for example, Flow Guard offers numerous specific advantages for your email infrastructure and your domain:
Not yet using NoSpamProxy?
NoSpamProxy reliably protects your company from dangerous spam emails and offers many other security features. Request your free trial now!





