Suspicious User-Agent String 'iot' Observed

Tim Peck@timpeck

•updated Nov 11, 2025•1•0•21

This rule detects HTTP traffic where the User-Agent string contains the case-insensitive substring 'iot'. This could indicate activity from Internet of Things (IoT) devices, potentially malicious botnet activity, or other suspicious automated traffic originating from or targeting IoT devices.