---
title: "Scanning and spam · Ataris"
description: "Port scans, outbound spam, and egress abuse get your IP ranges blocklisted and your abuse inbox full. Ataris reads every sandbox's flows on the host and opens a case before the complaints arrive."
canonical: "https://ataris.dev/use-cases/network-abuse"
last-updated: 2026-11-02
---
# Stop sandboxes scanning and spamming from your IPs.

Port scans, outbound spam, and egress abuse get your IP ranges blocklisted and your abuse inbox full. Ataris reads every sandbox's flows on the host and opens a case before the complaints arrive.

## Every packet a sandbox sends crosses the host first.

The tap or veth interface is the one place a sandbox can't route around. Ataris reads flows there, per sandbox.

### 1. See: Flows per sandbox.

Destinations, ports, and connection rates on each sandbox's interface, attributed to the account that owns it.

Example (vm-8a02 · tap3): new dests / min = 2,140; ports = tcp/22; completed = 3%.

### 2. Detect: Scans, spam, and egress abuse.

A fan-out of short connections is a scan. A burst on port 25 is spam. Sustained traffic to targets the sandbox has no reason to reach is egress abuse.

Example (vm-8a02 · rules): port scanning = MATCH; outbound spam = no match; egress abuse = no match.

### 3. Act: A case before the complaint.

The case lands in the queue with the flows attached. Your team decides, and acts from its own tools.

Example (CASE #0422): account = trial · day 2; evidence = flow timeline; automatic action = none.

## What it covers.

Network abuse that starts inside a sandbox and ends in your abuse inbox.

- **Scanning.** Reconnaissance from your IPs. port scans, SYN sweeps, per-port fan-out.
- **Spam.** Mail from sandboxes. SMTP bursts, many recipients, new senders.
- **Egress abuse.** Traffic you don't want to carry. unusual destinations, sustained volume, per-sandbox history.

## Related

- [Abuse detection](https://ataris.dev/product/abuse-detection.md): Mining, scanning, spam, farmed free tiers
- [Case queue](https://ataris.dev/product/case-queue.md): Ranked, evidence-backed, report-only
- [Free-tier abuse](https://ataris.dev/use-cases/free-tier-abuse.md): Farmed credits and repeat signups

## Keep your IP ranges off blocklists.

Book a demo and we'll show scanning and spam detection on your network setup.

[Book a demo](https://ataris.dev/contact)