Multi-Regional Cloud Honeynet Dataset: A Distributed T-Pot Honeypot Deployment Across Azure Regions for Cyber Threat Analysis

This dataset includes a high-resolution honeynet dataset that can be used for independent analysis of the patterns of cyberattacks around the world. The information, which was gathered over 72 hours (June 9–11, 2025) on Microsoft Azure, includes 132,425 distinct attack events that were recorded by three honeypots (Cowrie, Dionaea, and Sentrypeer) spread across four geographically separated virtual machines. In addition to derived temporal features (hour, day, weekday, date), each event record contains enriched metadata such as UTC timestamps, source/destination IPs, autonomous system and organizational mappings, geolocation coordinates, targeted ports, and honeypot identifiers. Standardized protocol classifications are also included.