Summary

  • From 21 to 27 September 2026, APNIC recorded 173 million honeynet events from 98,958 distinct source IP addresses.
  • Adding the six sensor-level IP counts produces 113,299 appearances; cross-sensor de-duplication removes 14,341 repeated sensor/IP appearances.

A security dashboard can display a very large number and a more useful one in the same week. APNIC’s honeynet recorded 173 million events from 98,958 distinct source IP addresses between 21 and 27 September 2026. The first number measures activity. The second counts addresses that reached the sensors. They are not rival estimates of the same thing.

That distinction gets more interesting in APNIC’s sensor table. Cowrie, which imitates SSH and Telnet services, saw 72,256 source IPs and 121.1 million events. OpenCanary recorded 14,393 IPs and 34.5 million events. Across the whole network, APNIC reports 98,958 unique IPs. Add the six per-sensor figures and the calculator returns 113,299. The 14,341 gap is extra sensor/IP appearances that vanish when addresses are deduplicated across sensors. It is a measure of overlap’s arithmetic footprint, not a count of distinct overlapping addresses.

Even the displayed sensor shares total 115 percent because a source can appear in more than one sensor’s view.

OpenCanary’s RDP result makes the event counter’s temperament plain: 6,637 IPs generated 25.6 million connection attempts in a week, about 3,900 attempts per IP. A source-address count shows breadth; the attempt total shows persistence and load. One bot returning thousands of times is a different operational problem from thousands of sources arriving once. APNIC says it counts unique source IPs because one bot can create millions of log entries while another system connects once.

The regional map needs the same care. APNIC says its RIR-region view reflects where compromised devices and scanning infrastructure sit, not the physical location of the person controlling them. For incident response and threat sharing, APNIC shifts attention to Autonomous System Numbers; economy-level views can help work with National CERTs. The map is a remediation map, not a suspect board.

APNIC launched its Community Honeynet in 2019 to improve visibility into activity aimed at Asia Pacific networks. Its project description connects the observations to member tools such as DASH and to security information sharing. The report’s value lies in that operational chain: observe a service, count the right unit, identify the network context, then decide where remediation belongs.

Sources