Headquarters Address Page Scraping

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects repeated HTTP requests to a web server where the URI contains the case-insensitive string "headquarters". It triggers an alert if a single source IP makes 10 such requests within a 30-second window. This behavior is indicative of an automated attempt to scrape information related to a company's headquarters address, potentially for reconnaissance purposes.