Skip to content

Real-time detection

Every five minutes, EmailShift looks at the last hour of events from your email platform.

What it detects

  • Volume spikes: sending far above what is normal for this weekday and hour, separately for each sending stream.
  • Sign-up bombing: a burst of never-seen recipients together with bounces, disposable addresses or no engagement. A typical sign of bots abusing your sign-up form.
  • Runaway automation: the same recipients receiving many messages within an hour.
  • Bounce and complaint bursts within the hour.

Volume checks need at least two weeks of history for that weekday and hour. Attack and burst detection works from day one.

Tuning it

Under Alerts → Settings → Real-time detection:

  • Sensitivity: Relaxed suits naturally bursty senders (weekly newsletters, lead generation); Strict alerts earlier.
  • Planned sends: announce a big campaign and volume alerts are muted for that window. Attack, runaway and burst detection stay active.

Teaching it

Every real-time case asks Was this expected?

  • Expected closes the case and mutes it for a few hours. After two expected volume spikes in the same weekday and hour, that slot counts as normal.
  • Not expected escalates the case.

Attack detections are never learned as normal.

Something unclear or missing? Tell us.