FortiBleed - Mass Scanning FortiGate SSL VPN Login Endpoint on Non-Standard Port

Kaung Khant Ko@kaungkhantko

•updated Jun 23, 2026•0•0•11

This rule detects mass scanning activity targeting FortiGate SSL VPN login endpoints on non-standard HTTPS ports (4433, 4443, 8443, 9443, 10443, 541). It specifically looks for HTTP requests containing '/login' in the URI, indicating an attempt to find or interact with the VPN login page. The rule uses a threshold to identify mass scanning, triggering an alert if a source IP makes 10 or more such requests within 60 seconds.