Potential Hello-World Scraper Botnet Activity

Title: Potential Hello-World Scraper Botnet Activity
Status: experimental
Description:Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string.
References:
  -https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan
  -https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30
Author: Joseph A. M.
Date: 2025-08-02
modified:None
Tags:

• -'attack.reconnaissance'
• -'attack.t1595'

Logsource:

• category: proxy

Detection:
  selection:
    c-useragent: 'Hello-World/1.0'
    cs-method: 'GET'
  condition:selection
Falsepositives:
  -Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent.
  -Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems.
Level: medium