Credential Stuffing Tool User Agent Detected

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects potential credential stuffing attacks by identifying HTTP requests to login pages that use user agents commonly associated with automated tools like 'python-requests', 'Go-http-client', or 'curl'. It triggers if 20 such requests are observed from the same source IP within 30 seconds, indicating a high volume automated attempt.