As cited
Copy frozen at (site build).
threat intel
Just 21 IP Addresses Are Now Behind Nearly Half of All RDP Scanning on the Internet
GreyNoise researchers identified that approximately 21 IP addresses account for nearly half of all Remote Desktop Protocol (RDP) scanning activity on the internet. The analysis reveals concentrated infrastructure patterns and rapid traffic shifts that create detection challenges for defenders. The findings highlight the concentrated nature of reconnaissance campaigns targeting RDP services globally.
Why it matters: Security teams need to understand that RDP reconnaissance is highly concentrated among a small set of IPs, enabling more efficient firewall rules, threat hunting, and monitoring prioritization to block or flag these known scanning sources.
- Source published
- First seen by Cybersecurity Tracker