Summary

  • APNIC’s RDP decoy saw 6,637 distinct source IPs make 25.6 million connection attempts in one week—almost 3,900 attempts per observed IP on average.
  • The signal is repeated contact at a remote-access service. APNIC reports no authentication-success tally for this RDP sample.

Every unattended service has a caller who believes persistence is a personality. APNIC’s RDP decoy heard from 6,637 distinct source IPs. In seven days, they made 25.6 million connection attempts.

The measurement comes from OpenCanary, a honeypot that imitates remote-access and database services. APNIC’s rebuilt honeynet ran this observation from 21 to 27 September 2026. Remote Desktop Protocol, usually shortened to RDP, was the busiest OpenCanary service by source-IP count. Microsoft SQL Server followed with 3,598 IPs; VNC had 3,179.

The attempt totals make the RDP figure more interesting than the address count. Its 6,637 source IPs generated 25.6 million attempts—roughly 3,900 each over the week. VNC recorded 4.2 million attempts from fewer than half as many IPs. The RDP decoy therefore received about six times the VNC connection volume from about twice the number of sources. APNIC describes the traffic as persistent: after reaching an exposed service, the callers kept returning.

That is not a headcount of successful logins. APNIC gives a connection-attempt total for RDP, not an authenticated-session tally. Its near-3,900 figure is an average across source IPs; the report does not publish the per-address distribution. A source address can also change hands, move, or represent traffic behind shared infrastructure. The useful observation is the pressure at the decoy, not a census of people or machines.

Why care about a fake desktop? Because the decoy is copying a real administrative doorway. RDP can let staff manage a machine from elsewhere; an internet-facing listener turns that convenience into a service every scanner can find. CISA’s #StopRansomware Guide says not to expose RDP to the public Internet. Where remote access is necessary, CISA recommends controls such as restricting source networks, putting a VPN or other secure access layer in front, requiring multifactor authentication, monitoring RDP logs and setting account lockouts after a defined number of attempts.

The APNIC sample does not show a successful break-in. It shows how cheaply one exposed doorway can collect repeat knocks. A useful operator dashboard would keep four counters separate: distinct source IPs, connection attempts, authentication failures and accepted sessions. The first two show who reached the door and how often. The latter two show whether anyone got farther. Mixing them into one “attack” number is how a busy log becomes a bad incident report.

The missing record is straightforward: APNIC has not published an RDP success count or a comparable second week. A later sample with the same sensor, time window, source-IP count, attempt distribution and authentication outcomes could show whether this was a burst or the background hum. Until then, the result is still actionable. If a business does not need public RDP, close the public door. If it does, put a controlled entrance in front of it and count what gets through.

The public Internet has no receptionist. The firewall has to be one.

Sources: APNIC’s one-week honeynet report; APNIC Honeynet programme; CISA #StopRansomware Guide.