High Volume AiTM Phishing Spike

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•7

Generates a macro-level alert identifying a rapid influx of emails containing links routing through known AiTM reverse proxy architectures, specifically targeting domains like onrender.com, web.app, and workers.dev. The rule triggers if more than 100 such threats are observed within a one-hour window for a given URL domain.