Bulletproof Hosting Infrastructure Access Detected

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects HTTP access to domains or hosts associated with bulletproof hosting infrastructure. It specifically looks for hostnames containing '.ru/', '.cn/', 'frantech', 'serverius', or 'combahton'. A threshold of 5 occurrences within 60 seconds from the same source IP triggers the alert.