In this project, honeypots have been configured and deployed via Google Cloud Platform in three geographically distinct locations: Sweden, the USA, and China. The purpose of the experiment is to examine whether the geographical placement of a honeypot affects attack patterns, with a particular focus on which ports attackers target in different regions.

To collect and analyze data, we have used T-PotCE, an advanced honeypot platform that integrates multiple honeypots to identify and log malicious activities. By monitoring and comparing attacks from the three different regions, we have been able to identify differ-ences in the most frequently targeted port numbers and the origin of these attacks.

The results show clear differences in attack patterns depending on geographical location.

For example, the honeypot in Sweden was primarily targeted by attacks on ports related to web and network services (80, 443, 445, 9200), while honeypots in the USA and China were more frequently attacked on port 5060, which is used for SIP (Session Initiation Pro-tocol). Furthermore, the analysis shows that attacks against Sweden mainly originated from the United States, while honeypots in the USA and China were largely attacked from Romania.

This study provides a deeper understanding of how cyber threats can vary depending on geographical location and how attackers target specific services in different parts of the world.