In Fraud Monitor, you can configure different thresholds for different lists (Blocklist, Ratelimit, and Redirect) based on the metric rules, Destination Based Traffic Spikes or Call Volume.

When the configured threshold is reached, the corresponding suspicious user/Phone number is moved automatically to the respective list as configured.