Social Media Account Hijack Login Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects multiple login attempts to social media platforms (Twitter, X, Instagram, Facebook) from a single source IP address within a short timeframe. It specifically looks for HTTP POST requests to URIs containing 'login' on these domains. A threshold of 10 attempts within 30 seconds triggers the alert, indicating a potential brute-force or credential stuffing attack aimed at hijacking social media accounts.