Possible bulk nuclei critical-severity vulnerability scan against public-facing services

Duo Tech@duotech

•updated Jul 27, 2026•1•0•3

Detects high-frequency HTTP GET request patterns indicative of bulk vulnerability scanning using the Nuclei scanner against public-facing web services. The rule triggers when a source IP initiates 250 or more requests within a 300-second window, excluding pre-authorized scanner source IP addresses.