Email Bombing Attack - High Volume Inbound Emails

Darshan Thummar@Mighty

•updated Jun 12, 2026•2•0•5

This rule detects a high volume of inbound emails to port 25 (SMTP), indicating a potential email bombing attack. It triggers an alert if more than 100 emails are received from a single source IP address within a 60-second window.