21 IPs drive half of global RDP scanning traffic

At a glance

What this is: GreyNoise tracked a small hosted fleet that briefly dominated global RDP scanning traffic and then collapsed just as quickly, highlighting how concentrated source activity can distort defensive baselines.

Why it matters: IAM and security teams that still treat internet-facing RDP as ordinary background noise risk missing a bursty, highly concentrated probing pattern that can precede password attacks and access compromise.

By the numbers:

• A fleet of 21 IP addresses produced 1,856,167 of the 2,753,274 RDP Crawler sessions observed globally on April 7, 2026.
• Across April 5 to April 7, the same fleet accounted for 49.7% of global RDP Crawler activity.
• RDP Crawler sessions from AS213438 fell from 1,856,167 on April 7 to 1,795 on April 8 and then to zero on April 9.

Context

Remote Desktop Protocol exposure is a governance problem before it becomes a network problem. When attackers can scan a small set of internet-facing hosts and quickly test logon paths at scale, the issue is not just traffic volume but the persistence of reachable remote access and weak credential assumptions. Remote Desktop exposure remains a common entry path because it offers a direct route into user and administrator sessions.

This article is about scanning, not confirmed compromise. The meaningful signal is concentration: a tiny number of hosted IPs temporarily dominated a global probing category, then disappeared, which means defenders need to think in terms of bursty infrastructure, not stable attacker fingerprints. That is especially relevant for identity teams that still allow remote admin access without tightly governed authentication and monitoring.

Key questions

Q: What should teams do first when exposed RDP starts drawing heavy scan traffic?

A: First, confirm whether the service truly needs internet exposure and remove direct inbound access where possible. Then block or rate-limit the source blocks, review failed logons for password spraying patterns, and verify that MFA and lockout policies are enforced on every reachable RDP endpoint. The goal is to cut the path from probing to credential abuse before attackers can turn scanning into a live session.

Q: Why does concentrated RDP scanning increase account compromise risk?

A: Because scanning is the first step in an authentication attack path. Once an exposed endpoint is discovered, attackers can test credentials at scale, and any weak or reused password may open an interactive remote session. RDP gives them direct access to the same login surface that legitimate users depend on, so weak identity controls turn a simple scan into a potential foothold.

Q: Where does RDP exposure fail in practice?

A: It fails when organisations treat reachability as harmless and leave remote desktop open without strong authentication, monitoring, and restrictions on who can connect. In that state, scanning traffic becomes an actionable signal for brute-force attempts rather than background noise. The failure is not the protocol itself, but the absence of control around the login surface.

Q: What happens when internet-facing RDP is not tightly governed?

A: A small number of scanners can repeatedly find the service, probe credentials, and create a foothold that looks like a legitimate remote session. That increases the chance of internal access, especially where privileged accounts are reachable from the same endpoint. The governance gap is allowing a high-risk access path to remain broadly available without fast revocation and strong policy enforcement.

Technical breakdown

Why concentrated RDP scanning breaks source-based detection

RDP scanning at internet scale is usually distributed across many IPs and autonomous systems, so defenders often rely on broad reputation feeds, geolocation trends, and volumetric thresholds. This case is different because a small hosted fleet generated an outsized share of the traffic, which means source concentration can shift faster than static blocklists or country-level baselines can adapt. The operational risk is not just that RDP is being scanned, but that the source pattern can collapse and reappear in a new shape within days. That makes single-signal detection brittle.

Practical implication: Treat concentrated RDP bursts as a moving infrastructure pattern, not a one-time anomaly, and tune controls to the source network as well as the destination service.

How brute-force pressure follows exposed remote desktop

RDP scanning is the reconnaissance phase of a familiar attack path. Once scanners find an exposed endpoint, the next step is typically authentication abuse through password spraying, brute-force attempts, or credential stuffing against interactive logon. Because RDP is a remote session protocol, success often gives an attacker a foothold that looks operationally valid rather than obviously malicious. That is why exposed RDP matters even when no exploitation vulnerability is involved: the service itself creates a direct path to high-value sessions and, in many environments, to privileged accounts. See the Remote Desktop (RDP) Security Guide.

Practical implication: Require stronger remote access controls and review failed-authentication patterns on exposed RDP before they become an interactive foothold.

Why burst-and-crash scanning matters for identity governance

The burst-and-crash pattern suggests centrally managed scanning infrastructure rather than opportunistic noise. For identity governance, that matters because exposure windows can be short and intensely targeted, which reduces the value of slow-moving review cycles and one-time perimeter assumptions. The control question becomes whether remote access is continuously governed, monitored, and revocable when the source landscape changes quickly. In practical terms, this is an identity assurance problem as much as a network hygiene problem, because the service being probed is an authentication entry point. See the NHI Lifecycle Management Guide.

Practical implication: Align remote access policy, monitoring, and credential controls to short-lived probing patterns rather than periodic review cadences.

Threat narrative

Attacker objective: The objective is to find exposed Windows remote access services and convert weak authentication into interactive footholds.

1. Entry begins with broad internet scanning of exposed RDP endpoints to identify hosts that answer on the service port.
2. Credential harvesting or abuse follows when operators test logon paths with brute-force attempts or password spraying against reachable systems.
3. Impact occurs when a valid remote session is obtained, creating a foothold that can lead to internal access and lateral movement.

NHI Mgmt Group analysis

Concentrated scanning changes the defensive problem from volume to source governance. When 21 IPs can account for nearly half of a global probing category, reputation and geolocation baselines lose predictive value very quickly. Teams that still tune controls to country-level patterns will miss how fast hosted infrastructure can rotate or vanish. The practitioner lesson is to govern source concentration as a live risk signal, not a background statistic.

RDP remains an identity problem because the attack path ends at authentication. The article is not about a software flaw, it is about the economics of exposed remote login. Once a scanner finds RDP, the next control boundary is password strength, MFA coverage, and lockout handling on the authentication path. That is where remote access governance and identity security overlap most sharply, especially for administrator-grade sessions.

Burst-and-crash infrastructure is a named governance signal, not just a threat pattern. The same cluster ramped, peaked, collapsed, and resurfaced within 30 days, which means defenders should expect unstable scanning infrastructure rather than fixed adversary infrastructure. That makes static watchlists insufficient on their own and pushes teams toward continuous telemetry, rapid block decisions, and service-level exposure reviews. The practitioner conclusion is simple: remote access controls must be able to respond faster than the probing fleet can reconstitute.

Internet-facing RDP should be treated as a controlled identity surface, not a convenience service. The moment a remote desktop endpoint is reachable from the internet, it becomes part of the organisation's authentication attack surface. That is where NHI lifecycle management thinking becomes relevant even in a human-access context: reachability, account scope, and revocation discipline all determine whether a session can be abused. The practitioner implication is to govern remote access like a privileged entry point, not a generic remote tool.

Source concentration is now a detection engineering problem as much as a network one. If a handful of source blocks can dominate a tag, then detections that over-weight historical country shares or broad ASN reputation will drift. Security teams need to ingest source-network shifts into monitoring, blocking, and triage so the control plane reflects the current scanning distribution. The practitioner conclusion is to refresh source intelligence continuously, not quarterly.

What this signals

RDP exposure is becoming a source-concentration problem. When a narrow hosted fleet can dominate a global scanning category, defenders should watch for abrupt shifts in source geography, ASN ownership, and port mix rather than assuming the threat surface is stable. The right response is to treat scan concentration as a live telemetry input for control tuning, not just a threat-intelligence curiosity.

Remote desktop governance now sits at the intersection of access policy and detection engineering. Teams that still permit direct inbound RDP need to combine authentication hardening, source-based monitoring, and rapid block decisioning or they will always be one burst cycle behind. The bigger signal is that the identity layer, not just the network layer, determines whether a probing campaign becomes a compromise path.

For practitioners

• Block the four concentrated /24 source blocks Add the Amsterdam and Lelystad network blocks tied to the fleet to inbound RDP scanning block rules and monitor for new source IPs in the same ASN.
• Review authentication logs on exposed RDP services Look for failed logon bursts, repeated username patterns, and short interval retries from the observed source networks since April 5.
• Audit non-standard RDP ports at the edge Check for services listening on 3390, 3391, and 3392 as well as standard 3389, because the fleet actively probes alternate ports.
• Tighten remote access authentication controls Require MFA, review lockout policies, and remove unnecessary internet exposure for Windows remote desktop endpoints that do not need direct inbound access.
• Track burst-and-crash source patterns Treat rapid scan ramp-ups followed by silence as a recurring infrastructure behaviour, and feed that pattern into threat intelligence and detection tuning.

Key takeaways

• A tiny set of hosted IPs can dominate global RDP probing, which makes source concentration a meaningful security signal rather than a noisy anomaly.
• The article shows that scanning pressure can shift rapidly across countries and autonomous systems, so static reputation baselines age out quickly.
• Defenders should govern exposed remote desktop services as authentication attack surfaces, with strong login controls, source blocking, and continuous monitoring.

Related NHI Mgmt Group resources: Remote Desktop (RDP) Security Guide · NHI Lifecycle Management Guide · Lateral Movement Guide

Key terms

• Remote Desktop Protocol: Remote Desktop Protocol is a Microsoft remote access technology that lets a user control a machine over the network. In security terms, it becomes a high-risk identity pathway when exposed directly or protected only by reusable credentials and weak privilege boundaries.
• RDP Scanning: RDP scanning is the practice of probing internet-facing Remote Desktop services to identify reachable systems and, in some cases, known vulnerabilities. It is often used to map exposure at scale, support brute-force attempts, or find hosts that are likely to be targeted next.
• Burst-and-crash infrastructure: Burst-and-crash infrastructure is a scanning or probing pattern where source volume surges quickly and then drops to near zero. It usually indicates centrally managed tooling, rapid rotation, or temporary hosting capacity, and it complicates static detection baselines.
• Source concentration: Source concentration occurs when a small number of IPs, ASNs, or network blocks produce a disproportionate share of hostile traffic. It can distort reputation feeds and geolocation assumptions, so defenders need current telemetry rather than broad historical averages.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management for practitioners who need to connect identity control to operational risk. It is suited to security teams building stronger access governance across human and non-human programmes.