Service Abuse

Description

That can be mass account creation, abuse of a free plan, sending thousands of messages through a form, excessive API use, mining on somebody else's infrastructure, or using the password reset system as a spam mechanism. Every single request looks legitimate; the abuse shows in the volume, the intent and the pattern.

This threat is awkward because it often passes classic protection. There is no malicious file and not necessarily any forbidden request. There is a function you built yourself, and somebody is using it as a tool against you.

Examples

• The attacker creates fake accounts in bulk and consumes the platform's resources.
• The password reset function is used to send a large number of emails to one person or one domain.
• The free tier of a cloud service is used for automated cryptocurrency mining or for processing somebody else's workloads.

Notes

• A legitimate function without limits easily becomes a free tool for an attacker.
• Service abuse is often invisible in one request and visible in a series. That is why quotas, reputation, anomalies and rate limiting matter more than the syntax of the request.