Proxy HTTP GET traffic using Hello-World/1.0 user-agent (possible scraper botnet)
Flags proxy GET requests using the Hello-World/1.0 user-agent, which may indicate automated scraping.
FreeReviewedSigma · Medium · v2
- Category
- proxy
- Author
- Joseph A. M. (SigmaHQ), DRL 1.1
- Published
- 2025-08-02
- Updated
- 2026-07-31
ATT&CK techniques
ReconRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags outbound proxy HTTP requests where the method is GET and the user-agent is exactly "Hello-World/1.0". Such automation can be used by scraping infrastructure to blend in with legitimate browsing patterns, making it valuable for identifying potential bot activity. It relies on proxy telemetry containing HTTP method and user-agent fields.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
proxy-traffic-with-hello-world-1-0-user-agent-using-get-1712bafe
title: Proxy HTTP GET traffic using Hello-World/1.0 user-agent (possible scraper botnet)
id: 570b7871-bcc8-48a1-abe8-8bfa2ac6fe00
status: experimental
description: This rule flags outbound proxy HTTP requests where the method is GET and the user-agent is exactly "Hello-World/1.0". Such automation can be used by scraping infrastructure to blend in with legitimate browsing patterns, making it valuable for identifying potential bot activity. It relies on proxy telemetry containing HTTP method and user-agent fields.
references:
- https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan
- https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30
- https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_hello_world_user_agent.yml
author: Joseph A. M., Huntrule Team
date: 2025-08-02
tags:
- attack.reconnaissance
- attack.t1595
logsource:
category: proxy
detection:
selection:
c-useragent: Hello-World/1.0
cs-method: GET
condition: selection
falsepositives:
- Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent.
- Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems.
level: medium
license: DRL-1.1
related:
- id: 1712bafe-be05-4a0e-89d4-17a3ed151bf5
type: derived