3BB: Possible reconnaissance probing against internal sales portal agent.3bb.co[.]th

Arnold Chan@slaz

•updated Sep 15, 2026•0•0•1

Detects repeated suspicious network requests, including non-standard HTTP methods and URI structures, as well as TLS SNI anomalies, targeting the internal sales portal 'agent.3bb.co.th'. The rule triggers when a threshold of 20 requests within a 60-second window is reached from a single source, indicating likely automated reconnaissance or vulnerability scanning activity.