Between May 9 and May 18, 2026, GreyNoise observed a major spike in scanning of SonicWall SonicOS management interfaces. The May 12 peak of about 597,000 sessions was the largest single-day total on the SonicWall SonicOS API Scanner tag in 90 days, roughly 46x the typical daily volume. Earlier spikes on this tag (January 18, January 30 an…
Between March 12 and 18, 2026, the GreyNoise Observation Grid (GOG) recorded 242,666 new scanning IPs geolocating to Hong Kong, 48.9% of all new scanning IPs seen that week. 99.7% never completed a TCP handshake, so GreyNoise classes them as "spoofable" (unverified source addresses). They carried no payloads and triggered no signatures. G…
GreyNoise reports that 21 IP addresses in AS213438 (registered to ColocaTel Inc., Mahe, Seychelles) produced 1,856,167 of 2,753,274 global RDP Crawler sessions on April 7, 2026, or 67.4% of the worldwide total. Over April 5-7 the same fleet accounted for 49.7% of global RDP Crawler activity. All 21 IPs are geolocated to the Netherlands, w…
F5 Labs, with Efflux sensor telemetry, profiled a persistent information-disclosure scanner operating from 78.153.140.203 in a netblock of AS202306 (HOSTGLOBAL.PLUS LTD), a UK ISP. The IP was first seen on 10 January 2025, vanished on 10 April, and returned on 11 July 2025. It scans 130 unique URLs: 80.23% are variations of /.env, 11.45% …
F5 Labs reports a scanning campaign observed on its Honeynet in March 2026. It recorded 1,897 session-grouped attempts (2,821 raw events) tied to CVE-2018-14028, a WordPress 4.9.7 unrestricted file upload flaw, and the CVE entered the monthly top 10 after being absent in February. Instead of exploiting the upload flaw, the operator probes…
F5 Labs honeynet telemetry shows overall hostile activity rising 55.5% month over month in June 2026, a return to the levels of the earlier-year spike. Highlighted is CVE-2024-44000, an unauthenticated account takeover flaw (CVSS 9.8, CWE-522) in the LiteSpeed Cache WordPress plugin, which rose by 1,128 to 2,603 attacks (8). Scanning is i…