Cloud VPS Provider Access for Infrastructure Setup

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects HTTP network connections to common Cloud Virtual Private Server (VPS) providers (DigitalOcean, Vultr, Linode, Hetzner) where the URI content includes the word 'create'. This combination suggests an attempt to set up new infrastructure, potentially for malicious purposes, aligning with resource development tactics.