Scripted curl POST of hardcoded username/password credentials to tunnel /login endpoint

Duo Tech@duotech

•updated Aug 9, 2026•2•0•6

Detects curl POSTing hardcoded username/password-style credentials to a /login endpoint on a known tunnel domain (ngrok, Cloudflare Quick Tunnel, or localhost.run), indicating credential submission to an attacker-exposed tunnel endpoint.