Cloud Telescope Internet Background Radiation August 2023

This dataset results from a 47-day cloud-based Internet Background Radiation capture conducted in August and September 2023. The dataset contains unsolicited and unfiltered traffic arriving at 260 EC2 instances distributed across 26 different AWS regions on the planet. 10 instances per region. Traffic is comprised of malicious cybernetic activity, including port scanning, malware propagation and botnet infection attempts. In this experiment, we implemented high-level responders on TCP ports 23 and 80 to capture and record the commands that are issued when Mirai botnet and its variants infect computers and other IoT devices. All other TCP ports only respond to connection requests by completing the three-way handshake, which was implemented by a middle-interaction honeypot code created by the researchers. The architecture is reproducible. Terraform Infrastructure-As-Code is available at: https://github.com/lucasbeiler/ibr-iac.