Physical Location Data Harvesting via Web

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts to harvest physical location data via web requests. It specifically looks for HTTP GET requests where the URI contains both 'location' and 'address' (case-insensitive). A threshold of 15 such requests within 30 seconds from the same source IP triggers the alert, indicating a potential network scan or automated data collection activity.