First seen May 15, 2026 · Last seen May 21, 2026 · Malware Family
Public preview
IOC type, status and defensive guidance visible. Pro adds alert context, Pro+ adds exports and deeper relationships.
Context
Mock user agent string used by SwarmBot IoT botnet during credential brute-force scanning.
Defensive Guidance
Add to WAF/reverse proxy UA blocklist. Monitor web server access logs for this user agent string.
Tags
Safety Note
Fictional user agent string. Not a real botnet signature.
Actions
Related Threat Feed Items
Related Malware
