Speedtest calibration followed by port 37777 scan burst from same host

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•3

Detects a sequence of events where a host connects to 'speedtest.net' followed by a burst of outbound SYN packets to TCP port 37777. This pattern may indicate an adversary using legitimate web traffic to calibrate their scanning rate or bypass network controls before performing a targeted scan.