In the "Freezing" process, suspicious mails are being held back for a few minutes.

This opens a small time window to repeat the spam and virus scans with updated signatures and fingerprints. Frozen mails can be analyzed in an secure sandbox environment and in case of harmful behaviour the MD5 checksum can be compared to the other frozen mails. The freezing mechnism allows conclusions about the sender's intentions through indices like the frequency and high number of recipients.