Topic
Automated, indiscriminate probing of public IP space for exposed or misconfigured services, usually run from rented hosting capacity.
A ZoomEye query counted hosts answering on Kubernetes' default API port on 2026-09-20. The write-up keeps the unit honest: a host that responded to one port query, with no authentication test behind the number.
Reality
Three published exposure counts for the September 2026 SonicWall SMA1000 chain measure three different objects: identifiable banners, text mentions, and observed instances.
Reality
The fix for CVE-2026-85706 shipped on 10 September in 19.3.2, 19.2.6 and 19.1.8, and CISA listed the flaw as exploited the next day. A ZoomEye fingerprint count of 1,262,273 hosts does not report versions; it shows where to look.
Reality
The 30 July advisory asks water utilities to validate what is reachable from outside. A query of ZoomEye's Modbus fingerprint on 15 September matched 47,028 assets on the public internet.
Reality
F5 Labs logged more than 800 attacks and about 32,000 raw events against its honeypots in a month, using an April bypass of Vite's server.fs.deny to read .env files, cloud credentials and terraform.tfstate.
Perspective Coverage
3 publishersReality
A Go decoy on port 22 logged 3,888 login attempts from 666 addresses in 22 hours, and the part worth copying is the resolver that turns a loader's URL template into an address you can actually block.
Reality