Account Takeover via Credential Stuffing Attack

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects a potential account takeover attempt via a credential stuffing attack. It specifically looks for HTTP POST requests to a URI containing 'login' (case-insensitive) from a single destination IP address, with a high frequency (50 requests within 60 seconds). This pattern suggests an automated attempt to try multiple credentials against a login endpoint.