Disposable Email Account Creation Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects attempts to create or access disposable email accounts by monitoring HTTP traffic for specific keywords in the HTTP host header. It triggers an alert if it observes 5 instances of these keywords from the same source IP within a 60-second window. The keywords include common disposable email service domains like 'guerrillamail', 'tempmail', 'mailinator', and '10minutemail'.