RDP scanning concentration: what it means for exposure management

TL;DR: A fleet of 21 IPs generated 49.7% of global RDP Crawler activity over 48 hours and 67.4% on April 7, according to GreyNoise, showing how a small hosted cluster can dominate exposed-remote-desktop probing. For defenders, source concentration now matters as much as volume because country-level baselines can mislead detection and blocking decisions.

Editorial analysis by NHI Mgmt Group, based on content published by GreyNoise: “Just 21 IP Addresses Are Now Behind Nearly Half of All RDP Scanning on the Internet”.

By the numbers:

• RDP Crawler sessions from AS213438 fell from 1,856,167 on April 7 to 1,795 on April 8 and then to zero on April 9.

Key questions

Q: What should teams do first when exposed RDP starts drawing heavy scan traffic?

A: First, confirm whether the service truly needs internet exposure and remove direct inbound access where possible.

Q: Why does concentrated RDP scanning increase account compromise risk?

A: Because scanning is the first step in an authentication attack path.

Q: Where does RDP exposure fail in practice?

A: It fails when organisations treat reachability as harmless and leave remote desktop open without strong authentication, monitoring, and restrictions on who can connect.

Practitioner guidance

• Block the four concentrated /24 source blocks Add the Amsterdam and Lelystad network blocks tied to the fleet to inbound RDP scanning block rules and monitor for new source IPs in the same ASN.
• Review authentication logs on exposed RDP services Look for failed logon bursts, repeated username patterns, and short interval retries from the observed source networks since April 5.
• Audit non-standard RDP ports at the edge Check for services listening on 3390, 3391, and 3392 as well as standard 3389, because the fleet actively probes alternate ports.

Bottom line: A tiny set of hosted IPs can dominate global RDP probing, which makes source concentration a meaningful security signal rather than a noisy anomaly.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →