Wave of Citrix NetScaler scans use thousands of residential proxies
Over the previous week, tens of thousands of residential proxies were utilized in a concerted reconnaissance attempt to find login panels on Citrix NetScaler infrastructure.
The activity, which was seen from January 28 to February 2, was centered on listing product versions, suggesting a systematic search for information.
Platform for monitoring threats GreyNoise identified almost 63,000 different IP addresses that initiated 111,834 sessions as the origin of the scanning traffic. The researchers found that Citrix Gateway honeypots were the target of 79% of the traffic.
Approximately 64% of the traffic originated via residential proxies, which are IP addresses dispersed throughout the world that pass for real consumer ISP addresses read more about Wave of Citrix NetScaler scans us...