HTTP2 Excessive Requests Per Minute

Ankit Mehta@Secvyn

•updated Jun 4, 2026•5•0•8

This rule detects a high volume of HTTP/2 requests (more than 3000 per minute) originating from a single remote IP address, especially when these requests target a diverse set of URIs (more than 10 distinct URIs). This pattern can indicate a denial-of-service (DoS) attack, a web scanner, or other malicious automated activity attempting to overwhelm a service or enumerate resources.