MFA SMS Code Request Flooding Attack

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects a potential MFA SMS code request flooding attack. It triggers when a single source IP address makes 10 or more HTTP requests containing the string "send_code" in the URI within a 60-second window. This behavior is indicative of an attacker repeatedly attempting to request MFA codes, likely in an attempt to overwhelm the user or the system, or to facilitate a SIM-swapping attack.