Google Dorking for Target Site Recon

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects potential Google Dorking activity targeting a specific site. It triggers when a client makes 10 or more HTTP requests within 60 seconds to 'google.com' where the URI contains 'site:'. This pattern is indicative of an attacker or reconnaissance tool using Google's search operators to find information about a target domain.