Speedtest.net Probe Followed by Masscan SYN Burst (Recon Staging)

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•1

This rule detects a multi-stage reconnaissance behavior where an internal host first establishes a TLS connection to speedtest.net, followed immediately by high-volume TCP SYN packet activity (100+ events in 10 seconds), characteristic of network scanning tools like Masscan.