Private Data Broker Access Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects HTTP requests to known data broker websites such as Spokeo, Intelius, and BeenVerified. It triggers an alert if 10 or more such requests are observed from a single source IP within a 60-second window. This activity could indicate reconnaissance efforts to gather information about individuals.