SMS Pumping Attack via Bulk OTP Request
This rule detects a potential SMS Pumping Attack, specifically targeting bulk One-Time Password (OTP) requests. It triggers when a single source IP address makes more than 50 HTTP POST requests to a URI containing "send_sms" within a 60-second window. This behavior is indicative of an attacker attempting to exploit SMS delivery systems by repeatedly requesting OTPs, potentially leading to financial costs for the service provider or overwhelming users with messages.
Suricata
