Automated Dahua easy4ipcloud password-recovery abuse via serial enumeration

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•1

Detects high-frequency HTTP requests to the Dahua easy4ipcloud.com password recovery endpoint. The rule monitors for abnormal volumes of reset requests from a single IP address, which is indicative of an attacker attempting to use offline-generated recovery codes to bypass authentication on Dahua IoT devices.