Corporate Intelligence Subscription Service Access

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects HTTP requests to domains associated with corporate intelligence subscription services such as Dun & Bradstreet (dun.com, dnb.com) and Hoovers (hoovers.com). It triggers an alert if a single source IP makes 10 or more such requests within a 60-second window, indicating potential reconnaissance activity.