At The Edge Clear: June 01 - 08, 2026
Summary: GreyNoise's June 01-08, 2026 analysis period found the highest-intent activity aimed at remote-access login surfaces - RDP, enterprise SSL VPN, and router management - rather than any new vulnerability. A single host, 94.102.49.82 (AS202425, Netherlands), generated 4,180,759 sessions across a wide port range in a 48-hour burst, more than a quarter of all RDP-crawling traffic GreyNoise recorded that week, while Fortinet (686K) and Cisco (401K) drew six-figure SSL VPN bruteforcing and a MikroTik RouterOS brute-force campaign ran for a third straight week.
Why it matters: Eight of the ten busiest sources were classified malicious and a ninth suspicious, all on rented hosting mostly in the Netherlands - and the IPs rotate, so blocklists keyed to individual addresses will not hold while tag-based coverage does.
Read the original at GreyNoise Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026