Vendor Relationship Page Scraping

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects potential vendor relationship page scraping activity. It triggers an alert when a client makes 20 or more HTTP requests containing the word "vendor" (case-insensitive) in the URI within a 30-second window. This behavior could indicate an attacker or automated script attempting to gather information about an organization's vendors, which is a reconnaissance technique.