diff --git a/communication/http/reference-http-user-agent-string.yml b/communication/http/reference-http-user-agent-string.yml
new file mode 100644
index 00000000..b277500c
--- /dev/null
+++ b/communication/http/reference-http-user-agent-string.yml
@@ -0,0 +1,19 @@
+# generated using capa explorer for IDA Pro
+rule:
+  meta:
+    name: reference HTTP User-Agent string
+    namespace: communication/http
+    authors:
+      - "@mr-tz"
+    scope: function
+    references:
+      - https://www.useragents.me/
+      - https://www.whatismybrowser.com/guides/the-latest-user-agent/
+    examples:
+      - 0796F1C1EA0A142FC1EB7109A44C86CB:0x4043F0
+  features:
+    - or:
+      - substring: "Mozilla/5.0"
+      - substring: "like Gecko"
+      - api: urlmon.ObtainUserAgentString
+      - property/read: System.Net.HttpWebRequest::UserAgent
diff --git a/doc/format.md b/doc/format.md
index 4c7c4ecf..8eee2d5f 100644
--- a/doc/format.md
+++ b/doc/format.md
@@ -449,7 +449,7 @@ Examples:
 
 ```yaml
 - string: "Firefox 64.0"
-- string: "Hostname:\t\t\t%s\nIP adress:\t\t\t%s\nOS version:\t\t\t%s\n"
+- string: "Hostname:\t\t\t%s\nIP address:\t\t\t%s\nOS version:\t\t\t%s\n"
 - string: "This program cannot be run in DOS mode."
   description: MS-DOS stub message
 - string: "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}"