High-volume single-source SYN scan/brute-force against Dahua port 37777

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•2

Detects high-frequency TCP connection attempts to port 37777, commonly associated with Dahua surveillance devices. The rule uses a threshold of 200 connection attempts within 60 seconds from a single source, which is characteristic of mass-scanning or brute-force activity.