T-Pot Multi-Sensor (Sydney).

Honeypot Data – T-Pot – Sydney, Australia – November 2025

Executive Summary

Ah, the glamorous life of a honeypot in Sydney. November 2025 was no exception to the digital circus we've come to know and begrudgingly love. From tireless probing for open ports to predictable C2 hubbub, attackers were out in full force, and this T-Pot sensor had a front-row seat. The month's findings remind us that the internet's underbelly remains relentless, buzzing with the same programs and patterns that challenge both our patience and our protocols.

Key Stats

• Timeframe: November 2025
• Sensor Deployment: T-Pot multi-sensor (Sydney)
• Volume: Thousands of attacks observed – time to consider yoga for stress relief
• Standout ASNs and Infra Types: A delightful mix of cloud-based skulkers and IPs out of China, the US, and Southeast Asia. The bulletproof hosts are holding strong, like cockroaches in a nuclear apocalypse.

Campaign Narrative

November saw our usual digital miscreants at work, exploiting the convenience of cloud services to rain down a hail of opportunistic scans and IoT-targeted attacks. Whether they're aspiring hackers or just bored, these entities targeted ports 80, 22, and 23 with all the grace of an elephant on roller skates. Meanwhile, Mirai-style botnets seem determinedly naïve, still trying Telnet and SSH like it's 2016. And let’s not forget the malware campaigns like Emotet and TrickBot, determined to stay relevant in our reports.

Infrastructure Details

We're starting to think that bulletproof hosting companies need ethics training. Afghanistan and Eastern European IPs continued to shrug off takedown attempts like "targeted" is just another Tuesday. More creative adversaries leaned heavily on cloud platforms to launch effortlessly redeployable attacks. Meanwhile, research and academic IPs were spotted, likely indulging in their penchant for data under the guise of security research.

Malware and Behaviour

The month's chaos couldn’t go without its talk-show-worthy malware cameos. Among them, Mirai-style botnet behaviour noted for its endless drive to infiltrate IoT devices, while Emotet and TrickBot gave a nostalgic nod to all the daily commuters in our SOC. Hashes and URLs seen flitting about suggest links to known malware and phishing fun, with no signs of taking up a more respectable hobby anytime soon.

Detection and Mitigation

How do we put out these fires? Start with blocking known naughty IPs, but don’t rely on it like a silver bullet. Patch those IoT devices, and if you haven't yet, please make it your new year’s resolution. Awareness and training aren't just for Girl Scouts—empower your security teams to recognize threats and distinguish between real threats and the echo chamber of noisy research scans. And while we’re dreaming, maybe ISPs could champion an anti-bulletproof-hosting movement.

Closing Thoughts

The November 2025 data reaffirms the internet remains a bustling marketplace of shifty dealings, some veiled in the guise of innovation, others as blatant as a toddler's scribbles on the wall. Defenders, keep those shields raised and curiosity intact, because this cybersecurity tango dances on. Or maybe consider a new career in knitting? Whatever keeps you sane.