Massive RDP Scanning Activity Traced to Only 21 IP Addresses

Remote Desktop Protocol (RDP) allows two computers to communicate remotely. Through this protocol, a computer can be remotely controlled and monitored. Companies that allow remote work often use this technology to monitor compliance and provide technical support to employees.

COVID has made remote work a must for many companies, and RDP has been an essential tool. According to Statista, more than 50% of the companies they surveyed use RDP.

While RDP is an essential tool for many businesses that support remote work, it can also create security risks if exploited by attackers.

Tracking RDP Scanning Traffic

GreyNoise reported massive scanning traffic from only 21 IP addresses:

“A fleet of 21 IP addresses is now generating nearly half of all the RDP scanning traffic on the public internet. On April 7, 2026 alone, those IPs produced 1,856,167 of the 2,753,274 RDP Crawler sessions observed globally by the GreyNoise Observation Grid (GOG) — 67.4% of the worldwide total.”

The scanning lasted for 48 hours, with the 21 IP addresses accounting for 49.7% of total activity during that time.

All the IP addresses came from the Netherlands, and they use the following /24 network blocks:

●    193.142.147.0/24

●    185.196.220.0/24

●    79.124.8.0/24

●    45.134.225.0/24

Scanning for Vulnerabilities

Scanning RDP worldwide itself is not an attack. However, it is considered the first process in initiating an attack. These scans can reveal which RDP transaction is open. An exposed RDP service could be targeted by attackers using brute-force attacks to try to gain unauthorized access. Millions of RDP connections are available for scanning daily, and some of them are bound to be susceptible. It’s just a matter of effectively scanning these connections to determine which is open or vulnerable.

Securing RDP Connection

Network administrators and IT personnel using RDP should take extra precautions because of its security risks. Fortunately, there are recommended practices for maintaining a secure connection.

For starters, the previously mentioned IP addresses should be blocked as soon as possible. These IP addresses are no longer scanning, but they could return at any time, and any exposed connection could be detected. Blocking these IP addresses prevents them from snooping and scanning.

These scans use a brute-force password attack on an open connection. This type of attack could be easily prevented by limiting the number of password attempts. Configuring this type of security is relatively simple, but it upgrades security to another level.

Network Level Authentication, or NLA, is also highly recommended. Nordlayer, a network security platform powered by Nord VPN, identifies the advantage of NLA since it “adds an extra layer of authentication for every session. Users seeking RDP access must supply an additional form of identification, such as smart cards, one-time passcodes, or biometrics.”

RDP is essential for many businesses with remote workers, and its use is expected to grow because of its practicality and demand. Securing RDP is essential for network and IT administrators to prevent attacks from affecting business operations.