# Ever wondered, why AWS SES is using a sandbox initially and requires you to ask for production?

**URL:** <https://forum.mautic.org/t/ever-wondered-why-aws-ses-is-using-a-sandbox-initially-and-requires-you-to-ask-for-production/36493>\
**Category:** General Discussion\
**Created:** [September 8, 2025, 3:55pm UTC](https://forum.mautic.org/t/ever-wondered-why-aws-ses-is-using-a-sandbox-initially-and-requires-you-to-ask-for-production/36493 "2025-09-08T15:55:54Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![dirk\_s](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/dirk_s/32/748_2.png) [@dirk\_s](https://forum.mautic.org/u/dirk_s)\
**Post date:** [September 8, 2025, 3:55pm UTC](https://forum.mautic.org/t/ever-wondered-why-aws-ses-is-using-a-sandbox-initially-and-requires-you-to-ask-for-production/36493/1 "2025-09-08T15:55:55Z")

</div>

This article describes a hacker operation, which used a compromised AWS API Key. Found out, there are SES rights assigned to it. Managed to send a blast through many regions at once, later also requesting production access programmatically with a ticket request.

That got granted - AWS wasn’t suspicious enough in that case. A later increase of sending limites got refused, but it was already enough volume for the spam operation.

> **[Hackers Exploit Amazon SES to Blast Over 50,000 Malicious Emails Daily](https://gbhackers.com/amazon-ses/)**
>
> A sophisticated cyberattack campaign where threat actors exploited compromised AWS credentials to hijack Amazon's Simple Email Service (SES).