One week on the APNIC honeynet: 99,000 IP addresses and 173 million events
Comments on “One week on the APNIC honeynet: 99,000 IP addresses and 173 million events”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
The APNIC Honeynet, rebuilt this year with upgraded sensors and new honeypots mimicking a Fortinet SSL-VPN portal and an Android debug port, recorded nearly 99,000 unique attacking IP addresses and 173 million events in the week of 21–27 September 2026.
Why it ranked
No. 26 of 124 with a score of 0.67. The panel rated it highest on substantiated (0.88) and new information (0.88), lowest on significance (0.53).
Every answer behind this is in the table under Score.
Score
0.67total under rubric v2.2
- Significance0.53
- Reader interest0.74
- Audience breadth0.67
- Practical relevance0.75
- Substantiated0.88
- Technical depth0.73
- New information0.88
- Counts against: Promotional0.10
- Counts against: Overclaim0.11
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.55 | 0.40 | 0.65 | 0.53 | 0.25 | +0.24 | +0.128 |
| Reader interest | 0.67 | 0.70 | 0.86 | 0.74 | 0.19 | +0.26 | +0.193 |
| Audience breadth | 0.70 | 0.60 | 0.70 | 0.67 | 0.10 | +0.13 | +0.087 |
| Practical relevance | 0.71 | 0.75 | 0.78 | 0.75 | 0.07 | +0.22 | +0.164 |
| Substantiated | 0.97 | 0.80 | 0.88 | 0.88 | 0.17 | +0.05 | +0.044 |
| Technical depth | 0.87 | 0.60 | 0.72 | 0.73 | 0.27 | +0.05 | +0.036 |
| New information | 0.92 | 0.80 | 0.93 | 0.88 | 0.13 | +0.05 | +0.044 |
| Promotional | 0.04 | 0.15 | 0.12 | 0.10 | 0.11 | −0.19 | −0.020 |
| Overclaim | 0.10 | 0.15 | 0.08 | 0.11 | 0.07 | −0.11 | −0.012 |
| Sum of contributions | +0.665 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.665 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-27/26/"><img src="https://rubric.hrih.si/badge/2026-10-27/26.svg" alt="Ranked #26 on Rubric, 27 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 1 matches source · 5 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
From 21-27 September 2026, almost 99,000 distinct IP addresses interacted with the APNIC honeypots, generating 173 million logged events.
The article gives no link or citation for it.
The article says “almost 99,000 distinct IP addresses interacted with our honeypots, generating 173 million logged events”
The source says No source to compare with.
No source givenNumber
Cowrie, the SSH and Telnet honeypot, saw 72,256 distinct IPs, nearly three-quarters of attackers.
The article gives no link or citation for it.
The article says “Nearly three-quarters of attackers targeted SSH or Telnet. Cowrie, our SSH and Telnet honeypot, saw 72,256 distinct IPs”
The source says No source to compare with.
Couldn’t checkDate
In 2023 ESET found that a kill switch had disabled the Mozi botnet, whose operators were reportedly arrested in 2021.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Its operators were reportedly arrested in 2021, and in 2023 ESET found that a kill switch had disabled the botnet”
The source says No passage could be compared.
Source cited by the article: eset.com/int/about/newsroom/press-releases/research/eset-research-infamous-iot-botnet-mozi-taken-down-via-a-kill-switch
Matches sourceCausal conclusion
Kaspersky links the SSH key comment mdrfckr to the Outlaw (Dota) botnet, a Perl-based cryptomining botnet that spreads through weak SSH passwords.
The cited source says the same thing.
The article says “The key ends with the comment mdrfckr, which Kaspersky links to the Outlaw (Dota) botnet, a Perl-based cryptomining botnet that spreads through weak SSH passwords”
The source says “Outlaw (also known as “Dota”) is a Perl-based crypto mining botnet that typically takes advantage of weak or default SSH credentials for its operations”
Source cited by the article: securelist.com/outlaw-botnet/116444
No source givenNumber
Five of the six most widespread malware samples delivered to Dionaea are WannaCry components, delivered together by at least 1,399 IPs.
The article gives no link or citation for it.
The article says “Five of the six most widespread samples are components of WannaCry, the ransomware worm that emerged in May 2017 through the EternalBlue SMB exploit”
The source says No source to compare with.
No source givenNumber
In August and September, roughly 80% of the approximately 3,000 Mozi-infected devices came from two Asia Pacific economies.
The article gives no link or citation for it.
The article says “In August and September, roughly 80% of the approximately 3,000 infected devices came from two economies in the Asia Pacific region”
The source says No source to compare with.
Couldn’t checkDate
Fortinet warned in April 2025 about a symbolic-link backdoor that let attackers keep read-only access to compromised FortiGate devices even after patching; 237 IPs probed for it.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “A smaller group of 237 IPs probed for the symbolic-link backdoor that Fortinet warned about in April 2025”
The source says No passage could be compared.
Source cited by the article: thehackernews.com/2025/04/fortinet-warns-attackers-retain.html
No source givenNumber
The 6,637 RDP attackers on OpenCanary made 25.6 million connection attempts, almost 3,900 each in a week.
The article gives no link or citation for it.
The article says “Those 6,637 RDP attackers made 25.6 million connection attempts, almost 3,900 each in a single week”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 3 pts, not on front page
Recorded for context only, checked 27 Oct 2026, 05:46 UTC. It played no part in the ranking.