MFA OTP Phishing Page Reverse Proxy Detected

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects HTTP requests that contain both 'otp' and 'verify' in the URI, which is indicative of a phishing page designed to capture One-Time Passwords (OTP) or Multi-Factor Authentication (MFA) codes. The rule is specifically looking for patterns associated with reverse proxy phishing techniques.