The Internet of Things (IoT) is an increasing number of (smart) devices of various types, often enough directly connected to the Internet without proper security mechanisms enabled.The types of devices range from simple IP-based Cameras to complex home routers with computing powers reaching that of personal computers. The fast development in terms of powerful hardware and the fact that those IoT devices are connected to the Internet 24/7 turns them into highly valuable targets for cyber crime.In 2016 the first larger IoT device-based botnets emerged, with Mirai being one of the most prominent examples, which infected more than 120.000 devices [1]. Mirai was also responsible for knocking almost 1 million customers of Deutsche Telekom AG the Internet, and is infamous for performing the largest and most disruptive denial of service (DoS) attacks in history [2]. Due to the leakage of Mirais source code to the public, new variants emerged, such as Reaper or the recent Satori botnet. In order to cope with future variants of Mirai and to avoid further impact on routers of Deutsche Telekom, we have adapted common security mechanisms to minimize detection and response times of IoT device-based botnets. In this talk, we will present our detection, analysis, and response strategy to deal with infected IoT devices from an ISP point of view.A high-level overview of our approach will be discussed in more detail during our presentation.To boost the early detection of suspicious activity on IoT related network ports, Deutsche Telekom extended its large number of honeypots, deployed across the Internet, with IoT-specific application simulations. Additionally, temporarily unused IP address ranges are used as a so-called black hole [3], to monitor general activity in form of backscatter and malicious traffic on the Internet. Together with basic machine learning algorithms, we use the input of these sensors as a trigger to start further in-depth investigation. Based on traffc fingerprinting, open-source intelligence information, and payload data from the honeypots, we are able to initiate a response chain, to minimize potential impact of an emerging IoT botnet.For the response chain, we use well-known open-source tools, such as IntelMQ for message/event processing and MISP (Malware Information Sharing Platform) to distribute relevant indicators across the enterprise to quickly identify infected systems within our responsibility and initiate appropriate mitigation actions.During our talk we will use the recent Satori IoT botnet as a showcase for our approach and to explain what kind of challenges still exist.