Masscan-style SYN scan burst targeting Dahua port 37777

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•1

Detects high-frequency TCP SYN packet bursts targeting port 37777 (commonly used by Dahua surveillance devices). The detection triggers when more than 50 SYN packets from a single source are observed within a 10-second window, suggesting automated reconnaissance or vulnerability scanning activity.