JDY Botnet CVE-2026-35616 Scanning Surge — Unique Src IP Spike on Edge Ports

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects anomalous spikes in inbound network connections to common edge device management ports (80, 443, 8080, 8443) by baselining the number of unique source IP addresses per destination over a 30-day window. It triggers an alert when the hourly count of unique source IPs deviates significantly (greater than 3 standard deviations) from the historical mean, which may indicate active network scanning or brute-force attempts.