JDY Botnet: High-Volume Outbound Port Scanning from SOHO/IoT Devices

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects high-volume outbound network scanning activity from a single internal source device. The rule identifies anomalous behavior characterized by rapid connection attempts to a large number of distinct destination IPs and ports, consistent with scanning patterns observed in botnets like JDY, which often target edge network infrastructure (Cisco, Ubiquiti, Draytek).