Stolen Data Purchase Platform Access

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts to access known online platforms used for purchasing stolen data, such as 'leakbase', 'breachforums', and 'raidforums'. It specifically looks for these keywords in the HTTP host header during client-to-server HTTP traffic.