Brute-force login attempts against Dahua camera admin CGI interface

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•4

Detects high-frequency login attempts directed at the management CGI interface of Dahua camera devices. The rule identifies multiple attempts from a specific source IP towards the camera's authentication endpoints (login, RPC2_Login) over common management ports (80, 37777).