Home lab · threat intel
T-Pot Honeypot Threat Intelligence
424k+ events logged; triaged Suricata exploit-attempt signatures and reported malicious IPs to AbuseIPDB
The T-Pot deployment follows the standard honeypot setup (spin up a VPS, run the T-Pot installer, open it to the internet). I left T-Pot’s defaults in place: Blackhole mode off, which is why commodity scanners like ONYPHE still show up in the data, and community submission to Sicherheitstacho at the installer default. The analysis and reporting is my own.
Why I built it
Reading about attacker behavior is not the same as watching it hit something you own. I put honeypots on the public internet to get real, unsolicited traffic and practice the boring but important part of threat intel: separating background scanning from anything worth a second look, and then doing something with it.
What I deployed and added
- Deployed T-Pot CE (the Hive install type, run standalone on one host) on a DigitalOcean droplet: Ubuntu 24.04, 8 GB RAM and 4 vCPUs, about $48 a month. I left it exposed to the internet to collect live traffic. T-Pot runs each honeypot as a Docker container behind a single public IP; the sensors that drew the most traffic were SentryPeer, Honeytrap, Ciscoasa, Cowrie, and Dionaea.
- Used the Kibana dashboards to break the traffic down by sensor, source ASN, country, and credentials, and to confirm the two exploit-attempt signatures Suricata flagged (CVE-2019-12263 and CVE-2020-11900).
- Triaged the Suricata signatures that fired against the sensors (T-Pot ships the Emerging Threats ruleset), separated the high-confidence exploit attempts from the background noise, and reported malicious source IPs to AbuseIPDB with the supporting evidence.
- Turned three of the more interesting single events into short write-ups: a VoIP toll-fraud campaign, a commercial scanner (ONYPHE), and non-standard-port TLS recon. Each was practice at explaining a finding the way a report would.
Screenshots
A walk through the build in screenshots. Click any to view it full size.
What I learned
- The volume is almost all commodity scanning: the credential word clouds are exactly what you would expect (root, admin, 123456, empty). The signal is not the count, it is the handful of sources and behaviors that stand out from it.
- The two CVE hits are a good reminder of long-tail risk. CVE-2019-12263 (URGENT/11, a VxWorks TCP stack flaw) and CVE-2020-11900 (a Treck TCP/IP stack flaw from the Ripple20 set) are both years old and still being sprayed at anything that answers.
- Every number on this page maps to the dashboard from while the sensors were running. If a figure is not in a screenshot, I left it off.
From this project
Single events from the honeypot logs I wrote up in more detail.