{
  "declared_links": {
    "economic_signal_ids": [],
    "relation": "topic-surface-only",
    "scan_signal_ids": []
  },
  "dek": "Nearly 99,000 unique IP addresses interacted with APNIC's honeynet in just one week, generating 173 million events across SSH, Telnet, SMB, VPN, web, and Android services. The results show that long-known botnets, weak credentials, and unpatched vulnerabilities continue to drive large-scale malicious activity across th",
  "desk": "connectivity",
  "event_id": "event-a4ce756d419552efc0288f84",
  "evidence_groups": [
    {
      "group_id": "apnic-community-research",
      "roles": [
        "research"
      ],
      "source_ids": [
        "apnic-blog"
      ]
    }
  ],
  "evidence_refs": [
    {
      "independence_group": "apnic-community-research",
      "item_id": "item-fc3829852035f21dfc7d680b",
      "published_at": "2026-10-26T04:15:47Z",
      "role": "research",
      "source_id": "apnic-blog",
      "source_name": "APNIC Blog",
      "title": "One week on the APNIC honeynet: 99,000 IP addresses and 173 million events",
      "url": "https://blog.apnic.net/2026/10/26/one-week-on-the-apnic-honeynet-99000-ip-addresses-and-173-million-events/",
      "version_id": "itemv-68989d154a9a0fdc666220b2"
    }
  ],
  "evidence_strength": "single-source",
  "headline": "One week on the APNIC honeynet: 99,000 IP addresses and 173 million events",
  "lead": false,
  "lead_reason": "Current single-source metadata is retained but not promoted as a lead.",
  "limitations": [
    "Palimpsest retained only feed title, canonical link, time, and a bounded plain-text excerpt; it did not fetch the article body.",
    "The evidence-strength label describes source structure, not truth, intent, impact, or causation.",
    "Declared instrument links are topical pointers until a separate scan or economic observation is joined by time and method.",
    "Title-similarity clustering can miss differently worded or cross-language accounts and can join closely worded updates.",
    "This dossier currently contains one independent evidence group and remains explicitly attributed."
  ],
  "mutation": {
    "kind": "unchanged",
    "previous_version_id": "eventv-08773457b4571f51ce795d4a"
  },
  "published_at": "2026-10-26T04:15:47Z",
  "reported_facts": [
    {
      "attribution": "APNIC Blog",
      "evidence_item_id": "item-fc3829852035f21dfc7d680b",
      "published_at": "2026-10-26T04:15:47Z",
      "statement": "APNIC Blog published “One week on the APNIC honeynet: 99,000 IP addresses and 173 million events”."
    }
  ],
  "topics": [
    "circumvention",
    "connectivity",
    "security",
    "technology"
  ],
  "updated_at": "2026-10-26T04:15:47Z",
  "url": "https://palimpsest.info/news/wire/event-a4ce756d419552efc0288f84/",
  "version_id": "eventv-08773457b4571f51ce795d4a"
}