Both of those are coming from telemetry, and mainly show attempts. Those telemetry are generally heuristic based so they overcount and are most often unsuccessful - it took much layer for actual honeypots to be hit. See my timeline in my other comment if you’re interested in details and extract dates
Both of those are coming from telemetry, and mainly show attempts. Those telemetry are generally heuristic based so they overcount and are most often unsuccessful - it took much layer for actual honeypots to be hit. See my timeline in my other comment if you’re interested in details and extract dates