For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/default_rules/def-000-h1z.md. A documentation index is available at /llms.txt.

User has used a disposable email address

Goal

Detect when a user is using a disposable email address.

Strategy

Monitor user email address in login events and detects whenever the domain is known to provide a disposable email service.

Triage and response

Investigate the activity of the user with ID {{@usr.id}} to determine if this is a throwaway account exploited to misuse your services.