Rate Limiting & Anti-Abuse · Chapter 5 of 5
Monitoring abuse in production
The four dashboards and three alerts that catch OTP abuse within minutes instead of on the invoice.
9 min read
Every control in this series has a threshold, and thresholds age. New markets, marketing campaigns and attacker adaptation all shift what normal looks like. Monitoring is how you learn your limits are wrong before your finance team does.
Four dashboards
- Sends per minute by country, stacked — the shape of normal.
- Conversion rate (verified / sent) by country and by prefix — the single best abuse signal.
- Spend per hour against budget — the number executives understand.
- Limit hits by key (destination, prefix, IP, device) — which defences are actually firing.
Three alerts
- Conversion for any country with > 50 sends/hour drops below half its 7-day median.
- Sends to a country you have never served exceed a small absolute number.
- Hourly spend exceeds 3× the same hour last week.
The kill switch
Have a per-country switch that stops sending, ready before you need it. When an alert fires at 3 a.m., the on-call engineer should be able to cut off a country in one action and investigate in the morning. Pair it with an automatic budget that does the same without a human.