Wave of Citrix NetScaler scans use thousands of residential proxies

A coordinated reconnaissance campaign targeting Citrix NetScaler infrastructure over the past week used tens of thousands of residential proxies to discover login panels.

The activity was observed between January 28 and February 2, and it also focused on enumerating versions of the product, indicating an organized discovery effort.

Threat monitoring platform GreyNoise traced the source of the scanning traffic to more than 63,000 distinct IPs that launched 111,834 sessions. According to the researchers, 79% of the traffic was aimed at Citrix Gateway honeypots.

Roughly 64% of the traffic came from residential proxies, with IPs spread across the globe, appearing as legitimate consumer ISP addresses and bypassing reputation-based filtering. The remaining 36% came from a single Azure IP address.

The activity strongly indicates pre-exploitation infrastructure mapping, rather than random internet scanning, GreyNoise says.

“The specific targeting of the EPA…