BGP Route Lookup for IP Block Discovery

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects HTTP requests to known BGP route lookup services (bgp.he.net, bgpview.io, ipwhois.io). This activity is often associated with reconnaissance, specifically IP block discovery, where an attacker or red team member is gathering information about an organization's network infrastructure.