Telnet Death: GreyNoise Labs Exposes Silent Scanning

Introduction

For decades, Telnet (port 23) has been a staple of network administration, but also a persistent security risk. In January 2026,GreyNoise observed a meaningful and abrupt decline in global Telnet exposure,coinciding with a series of events that suggest a purposeful effort to reduce the protocol’s presence on the internet. This post details the observed changes, potential causes, and practical implications for network operators and system administrators.

The Drop

On January 14, 2026, greynoise began observing a significant decrease in the number of publicly visible Telnet services. Prior to this date, scans consistently showed over a million active Telnet sessions. This decline wasn’t a gradual tapering; it was a sharp drop,suggesting an active intervention rather than passive attrition. While attributing direct causation is arduous, the timing is notable.

The combination of a Tier 1 backbone implementing what appears to be port 23 filtering, followed six days later by the disclosure of a trivially exploitable root-access telnet vulnerability (CVE-2025-8555), followed four days after that by a CISA KEV listing, is worth documenting and considering.

What the Post-Drop World Looks Like

The telnet landscape after January 14,2026 shows a recurring sawtooth pattern – periodic spikes followed by troughs (e.g., January 28 at 806K sessions, then January 30 at 191K). this coudl indicate intermittent filter application, routing flaps around the filtering infrastructure, or scanner campaigns that happen to use paths not affected by the filter.

The weekly averages tell the sustained story: