In this study, we set up 5 AWS instances on different geographic locations, namely Singapore, The US (Ohio), Canada, Germany, and Brazil. We set up TCP listeners on the ports listed in the paper linked below. As can be seen in the paper, we utilized simple server programs for IEC 60870-5-104 and IEC 61850, which provide responses according to the protocol. Because we did not emulate further system/device details, we claim they are categorized as low-interaction honeypot. During the study, we checked Shodan entries (https://www.shodan.io) about our honeypot instances, and confirmed that they are not flagged as honeypot, but are registered as ICS devices. Each honeypot instance runs Wireshark network protocol analyzer to capture hourly network traces. We ran our honeypot instances for over 8 months from September, 2017 to April, 2018.