You must log in or # to comment.
The headline claims “All RDP Scanning on the Internet” but the article says they only had data from their observation grid, not the entire internet.
Not true as it’s impossible to measure such a thing. But it makes sense that these numbers are what they are because ipv4 addresses are expensive.
The article explains exactly what it did measure and what this does not mean:
Every number in this post describes attacker activity reaching GreyNoise sensors, not confirmed impact on third-party environments.
That’s not what the headline says