Bulk SMS API Requests for Pumping Attack
This rule detects a high volume of HTTP POST requests to known SMS API providers (Twilio, Nexmo, Vonage) from a single source IP address within a short timeframe. This pattern is indicative of a 'pumping attack' or SMS fraud, where an attacker attempts to generate a large number of SMS messages, often to premium rate numbers, to incur charges or exploit vulnerabilities in billing systems. The threshold is set to 20 requests within 60 seconds from the same source.
Suricata
