/
← Voltar ao feed
medium

ColocaTel AS213438 fleet of 21 Netherlands IPs drives 67% of global RDP scanning in a second burst-and-crash cycle

1 fonte(s) · 1 atualização(ões) · publicado 09/04/2026 21:00 · coletado há 1 dia

GreyNoise reports that 21 IP addresses in AS213438 (registered to ColocaTel Inc., Mahe, Seychelles) produced 1,856,167 of 2,753,274 global RDP Crawler sessions on April 7, 2026, or 67.4% of the worldwide total. Over April 5-7 the same fleet accounted for 49.7% of global RDP Crawler activity. All 21 IPs are geolocated to the Netherlands, which moved from 7.17% to 53.86% of global RDP scanning share and displaced Romania as the top source country. The fleet crashed 99.9% on April 8 and went silent on April 9, repeating the burst-and-crash pattern the same ASN showed in early March 2026, 30 days earlier. GreyNoise does not attribute the activity to a named actor and observes only unsolicited traffic, not successful compromises.

Technical Details

  • AS213438 volume rose about 11x in 24 hours, from 180,293 sessions (April 6) to 2,011,365 (April 7). RDP Crawler made up roughly 85% of ASN sessions, and about 88% including the other two RDP tags.
  • The ASN had 32 active IPs in the window. The other 11 were engaged in web scanning, MySQL probing, Oracle WebLogic exploitation and broad reconnaissance.
  • The 21 fleet IPs sit in four /24 blocks, plus one low-volume IP (5.253.86[.]23, Lelystad) in a fifth /24. The pattern looks like hosting concentration rather than a botnet of compromised devices.
  • Shared TLS fingerprints across the higher-volume IPs suggest centralized tool deployment, though commodity scanners with default configs could produce the same pattern.
  • Targeted ports are RDP 3389 plus 3390, 3391 and 3392, and PostgreSQL 5432 plus 5430, 5431, 5433, 5434, 15432, 25432, 30432, 35432 and 55432.
  • The AS213438 March 5-11 peak was about 10.7 million sessions; it fell 97.7% on March 7. Activity resumed in the first week of April, and the last RDP Crawler session was seen at 2026-04-08T06:22:49Z.
  • IP 31.56.110[.]107 (Colchester, UK) is a suspicious broad-spectrum recon host seen since May 2019. It contributes no RDP Crawler sessions.
  • GreyNoise links the same ColocaTel Inc. trading name, Seychelles address and abuse contact ([email protected]) to the /24 containing 109.205.211[.]101. That /24 is routed via AS201814 (MEVSPACE, Poland) and was the source of about 7.97 million sessions in the week of March 12-18. The two RIPE org records are distinct (ORG-CI158-RIPE and ORG-CI159-RIPE), so operational continuity cannot be asserted.
  • GreyNoise cross-checked the April 7 spike against a concurrent sensor infrastructure change using five independent tests and concluded the spike is real.

Remediation

  • Add the four AS213438 RDP fleet /24 blocks to inbound RDP block or watchlist rules.
  • Review authentication logs on internet-facing RDP services for activity from these blocks since April 5.
  • Audit non-standard RDP ports (3390-3392) and non-standard PostgreSQL ports on the network edge.
  • Re-baseline country-level RDP scanning feeds, since weightings built before April 5 are misaligned.
  • Track AS213438 and the ColocaTel Inc. registration identity across RIPE records, since further rotations are likely.
  • Do not expose RDP directly to the internet. Source IPs listed are inbound scanning sources, not compromise indicators.

Linha do tempo

  1. greynoise.io ↗ · pub. 09/04/2026 21:00 · coletado 19/10 18:37 primeiro registro

    ColocaTel AS213438 fleet of 21 Netherlands IPs drives 67% of global RDP scanning in a second burst-and-crash cycle

    ler a análise desta fonte

    GreyNoise reports that 21 IP addresses in AS213438 (registered to ColocaTel Inc., Mahe, Seychelles) produced 1,856,167 of 2,753,274 global RDP Crawler sessions on April 7, 2026, or 67.4% of the worldwide total. Over April 5-7 the same fleet accounted for 49.7% of global RDP Crawler activity. All 21 IPs are geolocated to the Netherlands, which moved from 7.17% to 53.86% of global RDP scanning share and displaced Romania as the top source country. The fleet crashed 99.9% on April 8 and went silent on April 9, repeating the burst-and-crash pattern the same ASN showed in early March 2026, 30 days earlier. GreyNoise does not attribute the activity to a named actor and observes only unsolicited traffic, not successful compromises.

    Technical Details

    • AS213438 volume rose about 11x in 24 hours, from 180,293 sessions (April 6) to 2,011,365 (April 7). RDP Crawler made up roughly 85% of ASN sessions, and about 88% including the other two RDP tags.
    • The ASN had 32 active IPs in the window. The other 11 were engaged in web scanning, MySQL probing, Oracle WebLogic exploitation and broad reconnaissance.
    • The 21 fleet IPs sit in four /24 blocks, plus one low-volume IP (5.253.86[.]23, Lelystad) in a fifth /24. The pattern looks like hosting concentration rather than a botnet of compromised devices.
    • Shared TLS fingerprints across the higher-volume IPs suggest centralized tool deployment, though commodity scanners with default configs could produce the same pattern.
    • Targeted ports are RDP 3389 plus 3390, 3391 and 3392, and PostgreSQL 5432 plus 5430, 5431, 5433, 5434, 15432, 25432, 30432, 35432 and 55432.
    • The AS213438 March 5-11 peak was about 10.7 million sessions; it fell 97.7% on March 7. Activity resumed in the first week of April, and the last RDP Crawler session was seen at 2026-04-08T06:22:49Z.
    • IP 31.56.110[.]107 (Colchester, UK) is a suspicious broad-spectrum recon host seen since May 2019. It contributes no RDP Crawler sessions.
    • GreyNoise links the same ColocaTel Inc. trading name, Seychelles address and abuse contact ([email protected]) to the /24 containing 109.205.211[.]101. That /24 is routed via AS201814 (MEVSPACE, Poland) and was the source of about 7.97 million sessions in the week of March 12-18. The two RIPE org records are distinct (ORG-CI158-RIPE and ORG-CI159-RIPE), so operational continuity cannot be asserted.
    • GreyNoise cross-checked the April 7 spike against a concurrent sensor infrastructure change using five independent tests and concluded the spike is real.

    Remediation

    • Add the four AS213438 RDP fleet /24 blocks to inbound RDP block or watchlist rules.
    • Review authentication logs on internet-facing RDP services for activity from these blocks since April 5.
    • Audit non-standard RDP ports (3390-3392) and non-standard PostgreSQL ports on the network edge.
    • Re-baseline country-level RDP scanning feeds, since weightings built before April 5 are misaligned.
    • Track AS213438 and the ColocaTel Inc. registration identity across RIPE records, since further rotations are likely.
    • Do not expose RDP directly to the internet. Source IPs listed are inbound scanning sources, not compromise indicators.