Scheduled Scraper Fleet Hitting Gov/Mil Sites via Proxy Exits

Arnold Chan@slaz

•updated 27 days ago•0•0•1

This rule detects potential automated web scraping activity by identifying high-volume, repetitive network requests directed towards domains identified as government (.gov) or military (.mil). It correlates these network patterns with the execution of common browser automation frameworks (e.g., Puppeteer, Playwright) or headless browsers, indicating a likely coordinated scraping operation or bot activity.