FortiBleed Credential Stuffing High-Volume POST to FortiGate SSL VPN logincheck

Kaung Khant Ko@kaungkhantko

•updated Jun 23, 2026•0•0•7

This rule detects high-volume HTTP POST requests to the FortiGate SSL VPN logincheck URI, specifically '/remote/logincheck', over common HTTPS ports (443, 4433, 8443, 9443, 10443). It uses a threshold of 5 requests from the same source IP within 30 seconds to identify potential credential stuffing or password spraying attacks against FortiGate devices, often associated with the 'FortiBleed' campaign.