Velocity

Send-volume spikes: sending domains whose current-hour outbound volume jumped well above their learned hourly baseline. Domains need a short warm-up before spikes can be detected.