365,000 Attacks in Seven Days: What a TPOT Honeypot Sees on the Open Internet

Verdict: A single Ubuntu VM on Azure, deliberately exposed for seven days in late March 2025, logged roughly 365,000 malicious events — brute force, scans, exploit attempts and early-stage malware delivery. The top password was 123456. The top username was root. The top targeted port was 5060/SIP, not SSH. And the largest share of the shooting came from inside cloud providers, including the one hosting the honeypot.

Honeypots are a strange kind of instrument: they don't tell you who is attacking you. They tell you what the internet does to anything that answers. This is what it did to one machine.

#What was built

The deployment was deliberately unremarkable — the point was to look like another forgotten server, because that is what scanners are looking for.

TPOT is a honeypot distribution rather than a honeypot: one install script brings up a fleet of emulated services, wires them into an ELK stack and hands you dashboards, an attack map and a sensor health view. Opening 1–65535 is the configuration choice that shapes every number below — it turns the box into a target-rich surface for anything sweeping the internet, which is exactly what you want if the question is "what are scanners looking for?"

#The week in numbers

#Ports: the internet is not scanning what you think

The biggest surprise in the dataset is at the top: SIP, not SSH. 62,371 events against port 5060 in a single 12-hour window — the sort of volume you get when someone is sweeping for SIP registrars to abuse for toll fraud, voicemail break-ins and international call pumping. VoIP boxes are frequently deployed by a telco-adjacent vendor, forgotten, and left on default admin credentials; the scanners know this.

Behind it, the familiar three:

• SSH (17,533) — sustained brute force, never one attempt per connection.
• SMB (445, 14,458) — a legacy protocol that should have stopped crossing the internet a decade ago, still the preferred delivery path for ransomware operators because one successful hit is worth the sweep.
• Port 8000 (13,982) — alternative HTTP. A sudden spike here usually means someone is hunting a specific dashboard, proxy admin panel or development server left listening on the wrong port.

The pattern is not "attackers are sophisticated." It is "attackers are exhaustive." They don't need to know what you're running; they enumerate everything and let the responses sort it out.

#Credentials: the same five usernames, forever

root and admin account for most of the username traffic; 123456 alone is 40% of the password attempts. This is the Cowrie dataset doing what Cowrie does — recording every credential pair offered to an SSH prompt — and the picture has not changed in fifteen years. The long tail includes test, guest, support, mysql, postgres and other service accounts: the guesses a bot makes when it assumes a box was provisioned by someone following a tutorial and never revisited.

Two things are worth saying plainly:

1. These are not targeted guesses. They are the first few hundred entries of a wordlist, sprayed at every SSH port on the internet. If your root password is on that list, the attack does not need to know you exist.
2. The defence is not password complexity. It is disabling password authentication for SSH entirely, and putting key-based access plus a bastion in front of anything that must stay reachable.

#Where it comes from — and why "the US" is not an answer

The United States leads at roughly 40% of events, Romania second at 17%. That reading is misleading in a useful way: these are hosting locations, not nationalities. Compromised VPS instances, open proxies and rented cloud capacity are where the traffic originates. The report's own note is the correct one — the top countries are those with high internet penetration and large populations of unpatched, poorly-managed boxes, which makes them cheap to rent and cheap to own.

The ASN table says the same thing more precisely. Google Cloud Platform is the single largest source at 72,141 events. DigitalOcean, OVH, Akamai's Linode-backed cloud and a long list of resellers follow. Attackers are not breaking into these clouds; they are customers of them. A credit card and an API key gets you a VM with a clean reputation, a rotating IP and enough bandwidth to sustain a sweep.

There is also a reminder in that list not to treat every event as malice: Censys appears at 9,204 and Akamai at 11,899. Some of the "attack" traffic is security research and internet-wide measurement — the same activity, from the same address space, with different intent. A honeypot cannot tell you which is which.

#The loudest IPs

A single address, 2.57.121.207, accounts for 46,828 events — about one in eight of everything logged. That is either a compromised host running a scanner with the throttle removed, or a rented box doing exactly what it was paid for. The rest of the top ten is the usual mix of brute force, port scanning and malware delivery.

The AsyncRAT attribution is the interesting one: an address that delivered a remote-access trojan to the Dionaea sensor is not a scanner, it is infrastructure that has already been through the "what can I drop here" phase. Blocking a scanner costs you nothing but a firewall rule. Blocking delivery infrastructure costs you an incident response.

#Attacker OS: Linux, and old Linux

The report's prose attributes "more than 70,000 attempts" to Windows NT-based and Windows 7/8 systems, which sits awkwardly beside a pie that leaves only 6.4% for those slices. The two figures can be reconciled if the pie counts unique source hosts while the prose counts events — the report doesn't say which — so read the split as directional rather than arithmetic. What is not in doubt is the shape: Linux dominates, older kernels dominate within Linux, and macOS is essentially absent. Botnets run Linux because Linux is what you can compromise cheaply and automate without complaint.

The "barebone" slice is the one to notice. Stripped timestamps and minimal builds are not accidents; they are fingerprints scrubbed before the box was put to work.

#The CVEs that still pay

Twenty-year-old vulnerabilities are still being sprayed in volume: SNMPv1 (CVE-2002-0012, CVE-2002-0013), a BIND buffer overflow from 2001, RealVNC's 2006 authentication bypass. Mixed in, the report counted CVE-2023-46604 — the Apache ActiveMQ RCE from late 2023 — and CVE-2021-3449 in OpenSSL.

The economics haven't changed. A scanner that tries 200 exploit paths costs nothing to run and needs one unpatched host to pay for itself. Ageing CVEs are not "known" so much as unfixed — the population of vulnerable machines is what keeps the exploit in circulation, not the other way round.

#Suricata: what the signatures saw

The most-triggered signature — DoublePulsar backdoor, ID 2024766 at 49,435 hits — deserves a caveat. A signature name is not a finding. The ET rule family that detects DoublePulsar keys off SMB traffic patterns associated with the implant; on a host with SMB open to the internet and every port answering, scanner traffic alone will fire it thousands of times. Some of those hits may be real SMB exploitation attempts. Most are the noise floor of an internet-wide sweep.

The rest of the list is more legible:

• ET DROP Dshield Block Listed Source (43,097) — traffic from addresses already on a public blocklist. Useful for triage, self-fulfilling for statistics: you can only match a list of known-bad senders with traffic from known-bad senders.
• SURICATA STREAM ESTABLISHED packet out of window (43,357) — a stream anomaly, usually a sign of scanning tools that don't bother completing handshakes properly.
• Terminal Server traffic on non-standard ports (37,417) and RDP authentication bypass (15,847) — RDP remains the ransomware entry point of choice, so it gets scanned on every port, not just 3389.
• Hostile HTTP request (30,020) and HTTP request on unusual ports — web shells, admin panels and exploit kits, all pointed at whatever answers.
• NMAP -sS scan (10,631) and external IP lookup via ILS SNI (8,508) — reconnaissance, plain and simple.

None of this is a compromise. It is the sound of the internet checking whether one is available.

#What a honeypot actually tells you

Four honest conclusions from a week of being everybody's favourite target:

1. The exposed surface you forgot is the one being scanned. SIP at 62,000 events was the top port, and it is almost never in the threat model of a general-purpose cloud VM. If it answers, it is a target.

2. Default credentials are still the cheapest exploit. root/123456 at the top of the charts is not a failure of attacker imagination; it is a failure of provisioning defaults that persist across an industry.

3. Clouds are attack infrastructure. GCP, DigitalOcean, OVH, Linode and a pile of resellers dominate the source ASNs. Reputation-based blocking on cloud ranges is a blunt instrument, but "traffic from a cheap VPS that has never talked to us before" is a genuinely useful signal.

4. Honeypot data measures scanners, not adversaries. It tells you the shape of automated opportunism with unusual clarity, and almost nothing about a human who has chosen you specifically. Both matter; don't confuse them.

Moral: A server that answers will be attacked within minutes, by everything, forever. The honeypot's value is not that it caught 365,000 attacks — it's that it shows how little of that traffic needed a plan. Most of it needed a wordlist, a port list and a rented box.

#The detailed report

The full report — setup screenshots, the Elastic dashboard, the origin map, and the complete CVE and signature tables — is embedded below.