I've done quite a lot of looking at exposed k8s clusters, and one thing this piece doesn't really cover is what percentage of the 350 clusters they identified w

I've done quite a lot of looking at exposed k8s clusters, and one thing this piece doesn't really cover is what percentage of the 350 clusters they identified were in fact honeypots. You can find k8s clusters without auth using Censys as they specifically try to access things like pod lists, and from spinning through lists of those they tend to be obvious honeypots (e.g. lots of ports that wouldn't usually go together being exposed), although I have seen the odd cluster that looks a bit more realistic, unlike Aqua I didn't try accessing it directly as that could be dodgy legally :D If anyone wants to look at the list, Censys handily has a search query for "kubernetes clusters where the pod list is exposed without authentication" https://search.censys.io/search?resource=hosts&q=services.kubernetes.pod_names%3D%22*%22 https://search.censys.io/search?resource=hosts&q=services.ku...