Just 21 IP Addresses Are Now Behind Nearly Half of All RDP Scanning on the Internet
Summary: GreyNoise observed 21 IP addresses in AS213438, registered in RIPE WHOIS to ColocaTel Inc. of Mahe, Seychelles, generating 1,856,167 of 2,753,274 global RDP Crawler sessions on April 7, 2026 - 67.4% of the worldwide total - and 49.7% across the 48-hour window from April 5-7. The same ASN had produced roughly 10.7 million sessions the week of March 5-11, 2026, dropped 97.7% overnight on March 7, returned in early April, then fell 99.9% in a single day with its last RDP Crawler session at 2026-04-08T06:22:49Z.
Key Takeaway: Country-level RDP scanning weighting built before April 5 now points at the wrong place: the Netherlands rose from 7.17% to 53.86% of global share while Romania fell from 29.89% to 15.78%, even though Romania's daily rate actually rose about 8%.
Read the original at GreyNoise Blog ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026