Analysis of internet-facing service scanning against New Zealand organisations during Q3 2026 shows botnet activity targeting network and IoT devices remains the most prevalent form of scanning observed.
The data shows a particularly significant concentration around two services: Telnet (TCP/23) and SSH (TCP/22).
Both ports were targeted at rates orders of magnitude higher than the other most commonly scanned ports combined, highlighting the continued interest from automated threat infrastructure in discovering remotely accessible network and IoT devices.
Telnet and SSH Remain High-Value Targets
Telnet and SSH are commonly associated with remote administration of network infrastructure, servers, embedded systems and IoT devices.
While SSH provides substantially stronger security than Telnet when appropriately configured, an internet-accessible SSH service remains an attractive target for automated scanning.
Telnet presents an even greater concern where it remains enabled, as traditional Telnet communications do not provide the same level of protection expected from modern secure remote-access protocols.
The scale of scanning observed suggests that exposed services are being continuously tested by automated infrastructure looking for systems that may be vulnerable to:
- Weak or default credentials
- Vulnerable firmware or software
- Misconfigured services
- Exposed administrative interfaces
- Poorly secured IoT devices
- Systems suitable for subsequent inclusion in botnets
Despite this there stil seems to be an unawareness from Eletrical contractors which I have witnessed recently with overseas support contractors expressing their displeasure when I would refuse to expose an Organisation OT equipment directly via the internet due to the inherent risks.
Persistent Scanners
The analysis also provides an interesting insight into the nature of the scanning activity.
Just over a quarter of the IP addresses observed scanning these organisations were persistent, meaning they were detected repeatedly across multiple days rather than appearing as a single isolated scanning event.
This distinction is important for defenders.
A large volume of internet scanning is opportunistic and automated, but persistent activity can provide a stronger signal that particular infrastructure is repeatedly interested in an organisation’s exposed attack surface.
From a SOC perspective, identifying these recurring sources can therefore provide additional context when prioritising alerts and investigating internet-facing systems.
Ideally you can recode then identify the recidivist source subnets and block those as opposed to blocking individual IP addresses as it is much easier to block a class C subnet than 250 individual IP addresses. It is generally safe to say if you see 10 IPs scanning you out of a class C that the entire /24 subnet can be blocked.
Exposing SSH or Telnet Comes With Risk
The findings reinforce an important security principle:
Any decision to expose remote administration services directly to the internet should be treated as a significant security decision.
If SSH or, particularly, Telnet needs to be exposed externally, organisations should consider whether there is a safer alternative.
Where direct exposure is unavoidable, additional controls should be implemented wherever possible.
These can include:
- Restricting source IP addresses to known and trusted networks.
- Using VPN or zero-trust access rather than exposing the management service directly.
- Enforcing strong authentication, including MFA where supported.
- Disabling password authentication for SSH where practical and using strong cryptographic keys.
- Disabling Telnet and replacing it with a secure alternative such as SSH.
- Keeping the underlying device, firmware and operating system fully patched.
- Implementing appropriate network segmentation for management interfaces.
- Ensuring connection attempts and authentication activity are captured by the SIEM and monitored by the SOC.
- Alerting on repeated connection attempts, credential attacks and unusual geographic sources.
What This Means for New Zealand Organisations
The Q3 2026 scanning data provides another reminder that internet-facing attack surface is continuously being discovered and tested. CISA in the US has put a large focus on security OT networks for their organisations and Australia appear to be heading the same way with upcoming changes to the Essential 8.
Organisations do not need to be specifically targeted by a threat actor to be exposed to this activity. Automated botnets and scanning infrastructure can identify publicly accessible services at scale, often within a relatively short period after they become exposed.
For security teams, this makes external attack-surface visibility particularly important.
A newly exposed SSH service may begin receiving connection attempts almost immediately, while a forgotten Telnet interface on an IoT or network device can remain exposed for months or years without anyone realising it.
The safest internet-facing service is generally the one that does not need to be there.
Where remote administration is genuinely required, organisations should minimise exposure, restrict who can connect, enforce strong authentication and ensure the activity is visible to their security monitoring capability.
Threat Intelligence Takeaway
The dominance of TCP/23 and TCP/22 scanning in the Q3 2026 data demonstrates that attackers and botnets continue to actively hunt for remotely accessible network and IoT infrastructure.
For defenders, the message is straightforward: don’t treat internet-facing SSH as just another open port.
It is a heavily scanned service and should be deliberately exposed, tightly controlled and actively monitored.
About the Author
