Blog

Reports of Telnet’s Death Have Been Greatly Exaggerated

We see no evidence that specific core network autonomous systems have blocked Telnet, contrary to previous reports. We specifically see continued non-spoofable Telnet traffic from networks on which GreyNoise saw 100% drop-off. We suspect initial results may have been measurement artifacts or specific threat actors explicitly avoiding GreyNoise infrastructure, though determining this root cause is impossible without internal data.

3/25/26

The 24-Hour Exploit: How OpenClaw Scanning Ramped Up from Zero to Global in a Day

We detected OpenClaw exploitation scanning ramp up globally in lockstep with its public announcement, indicating attackers are not waiting for traditional intelligence sources like Censys or Shodan. Terrace Network's honeypot data shows a broad rise in scanning sources over time, suggesting widespread, automated bot activity rather than a small, focused campaign. The takeaway is simple: the window between “new tool announced” and “active exploitation in the wild” is now measured in hours, not weeks.