diff --git a/.github/ISSUE_TEMPLATE/general-issue-for-t-pot.md b/.github/ISSUE_TEMPLATE/general-issue-for-t-pot.md
index 631ce307..e86a858b 100644
--- a/.github/ISSUE_TEMPLATE/general-issue-for-t-pot.md
+++ b/.github/ISSUE_TEMPLATE/general-issue-for-t-pot.md
@@ -7,6 +7,8 @@ assignees: ''
 
 ---
 
+🗨️ Please post your questions in [Discussions](https://github.com/telekom-security/tpotce/discussions) and keep the issues for **issues**. Thank you 😁.<br>
+
 Before you post your issue make sure it has not been answered yet and provide `basic support information` if you come to the conclusion it is a new issue.
 
 - 🔍 Use the [search function](https://github.com/dtag-dev-sec/tpotce/issues?utf8=%E2%9C%93&q=) first
diff --git a/docker/fatt/Dockerfile b/docker/fatt/Dockerfile
index 7247823d..66ae4480 100644
--- a/docker/fatt/Dockerfile
+++ b/docker/fatt/Dockerfile
@@ -40,4 +40,4 @@ RUN sed -i 's/dl-cdn/dl-2/g' /etc/apk/repositories && \
 STOPSIGNAL SIGINT
 ENV PYTHONPATH /opt/fatt
 WORKDIR /opt/fatt
-CMD python3 fatt.py -i $(/sbin/ip address | grep '^2: ' | awk '{ print $2 }' | tr -d [:punct:]) --print_output --json_logging -o log/fatt.log
+CMD python3 fatt.py -i $(/sbin/ip address show | /usr/bin/awk '/inet.*brd/{ print $NF; exit }') --print_output --json_logging -o log/fatt.log
diff --git a/docker/glutton/Dockerfile b/docker/glutton/Dockerfile
index 7322eb54..7b0f141d 100644
--- a/docker/glutton/Dockerfile
+++ b/docker/glutton/Dockerfile
@@ -53,4 +53,4 @@ RUN sed -i 's/dl-cdn/dl-2/g' /etc/apk/repositories && \
 # Start glutton 
 WORKDIR /opt/glutton
 USER glutton:glutton
-CMD exec bin/server -i $(/sbin/ip address | grep '^2: ' | awk '{ print $2 }' | tr -d [:punct:]) -l /var/log/glutton/glutton.log > /dev/null 2>&1
+CMD exec bin/server -i $(/sbin/ip address show | /usr/bin/awk '/inet.*brd/{ print $NF; exit }') -l /var/log/glutton/glutton.log > /dev/null 2>&1
diff --git a/docker/heimdall/dist/app/app.sqlite b/docker/heimdall/dist/app/app.sqlite
index 827ac16d..5447bd06 100755
Binary files a/docker/heimdall/dist/app/app.sqlite and b/docker/heimdall/dist/app/app.sqlite differ
diff --git a/docker/p0f/Dockerfile b/docker/p0f/Dockerfile
index 5da6b822..3694bc06 100644
--- a/docker/p0f/Dockerfile
+++ b/docker/p0f/Dockerfile
@@ -32,4 +32,4 @@ RUN apk -U --no-cache add \
 # Start p0f
 WORKDIR /opt/p0f
 USER p0f:p0f
-CMD exec /opt/p0f/p0f -u p0f -j -o /var/log/p0f/p0f.json -i $(/sbin/ip address | grep '^2: ' | awk '{ print $2 }' | tr -d [:punct:]) > /dev/null
+CMD exec /opt/p0f/p0f -u p0f -j -o /var/log/p0f/p0f.json -i $(/sbin/ip address show | /usr/bin/awk '/inet.*brd/{ print $NF; exit }') > /dev/null
diff --git a/docker/suricata/Dockerfile b/docker/suricata/Dockerfile
index ae26908a..965600e0 100644
--- a/docker/suricata/Dockerfile
+++ b/docker/suricata/Dockerfile
@@ -34,4 +34,4 @@ RUN apk -U --no-cache add \
 #
 # Start suricata
 STOPSIGNAL SIGINT
-CMD SURICATA_CAPTURE_FILTER=$(update.sh $OINKCODE) && exec suricata -v -F $SURICATA_CAPTURE_FILTER -i $(/sbin/ip address | grep '^2: ' | awk '{ print $2 }' | tr -d [:punct:])
+CMD SURICATA_CAPTURE_FILTER=$(update.sh $OINKCODE) && exec suricata -v -F $SURICATA_CAPTURE_FILTER -i $(/sbin/ip address show | /usr/bin/awk '/inet.*brd/{ print $NF; exit }')
diff --git a/docker/suricata/Dockerfile.from.source b/docker/suricata/Dockerfile.from.source
index cbea5a5e..7c2a01be 100644
--- a/docker/suricata/Dockerfile.from.source
+++ b/docker/suricata/Dockerfile.from.source
@@ -137,4 +137,4 @@ RUN    apk -U add \
 #
 # Start suricata
 STOPSIGNAL SIGINT
-CMD SURICATA_CAPTURE_FILTER=$(update.sh $OINKCODE) && exec suricata -v -F $SURICATA_CAPTURE_FILTER -i $(/sbin/ip address | grep '^2: ' | awk '{ print $2 }' | tr -d [:punct:])
+CMD SURICATA_CAPTURE_FILTER=$(update.sh $OINKCODE) && exec suricata -v -F $SURICATA_CAPTURE_FILTER -i $(/sbin/ip address show | /usr/bin/awk '/inet.*brd/{ print $NF; exit }')
diff --git a/etc/compose/collector.yml b/etc/compose/collector.yml
index 6c16cf6c..1827e2fe 100644
--- a/etc/compose/collector.yml
+++ b/etc/compose/collector.yml
@@ -38,7 +38,7 @@ services:
      - "3389:3389"
      - "5432:5432"
      - "5900:5900"
-    image: "ghcr.io/telekom-security/heralding:2006"
+    image: "dtagdevsec/heralding:2006"
     read_only: true
     volumes:
      - /data/heralding/log:/var/log/heralding
@@ -52,7 +52,7 @@ services:
     network_mode: "host"
     cap_add:
      - NET_ADMIN
-    image: "ghcr.io/telekom-security/honeytrap:2006"
+    image: "dtagdevsec/honeytrap:2006"
     read_only: true
     volumes:
      - /data/honeytrap/attacks:/opt/honeytrap/var/attacks
@@ -73,7 +73,7 @@ services:
      - NET_ADMIN
      - SYS_NICE
      - NET_RAW
-    image: "ghcr.io/telekom-security/fatt:2006"
+    image: "dtagdevsec/fatt:2006"
     volumes:
      - /data/fatt/log:/opt/fatt/log
 
@@ -82,7 +82,7 @@ services:
     container_name: p0f
     restart: always
     network_mode: "host"
-    image: "ghcr.io/telekom-security/p0f:2006"
+    image: "dtagdevsec/p0f:2006"
     read_only: true
     volumes:
      - /data/p0f/log:/var/log/p0f
@@ -99,7 +99,7 @@ services:
      - NET_ADMIN
      - SYS_NICE
      - NET_RAW
-    image: "ghcr.io/telekom-security/suricata:2006"
+    image: "dtagdevsec/suricata:2006"
     volumes:
      - /data/suricata/log:/var/log/suricata
 
@@ -116,7 +116,7 @@ services:
      - cyberchef_local
     ports:
      - "127.0.0.1:64299:8000"
-    image: "ghcr.io/telekom-security/cyberchef:2006"
+    image: "dtagdevsec/cyberchef:2006"
     read_only: true
 
 #### ELK
@@ -140,7 +140,7 @@ services:
     mem_limit: 4g
     ports:
      - "127.0.0.1:64298:9200"
-    image: "ghcr.io/telekom-security/elasticsearch:2006"
+    image: "dtagdevsec/elasticsearch:2006"
     volumes:
      - /data:/data
 
@@ -153,7 +153,7 @@ services:
         condition: service_healthy
     ports:
      - "127.0.0.1:64296:5601"
-    image: "ghcr.io/telekom-security/kibana:2006"
+    image: "dtagdevsec/kibana:2006"
 
 ## Logstash service
   logstash:
@@ -166,7 +166,7 @@ services:
         condition: service_healthy
     env_file:
      - /opt/tpot/etc/compose/elk_environment
-    image: "ghcr.io/telekom-security/logstash:2006"
+    image: "dtagdevsec/logstash:2006"
     volumes:
      - /data:/data
 
@@ -179,7 +179,7 @@ services:
         condition: service_healthy
     ports:
      - "127.0.0.1:64302:9100"
-    image: "ghcr.io/telekom-security/head:2006"
+    image: "dtagdevsec/head:2006"
     read_only: true
 
 # Ewsposter service
@@ -199,7 +199,7 @@ services:
      - EWS_HPFEEDS_FORMAT=json
     env_file:
      - /opt/tpot/etc/compose/elk_environment
-    image: "ghcr.io/telekom-security/ewsposter:2006"
+    image: "dtagdevsec/ewsposter:2006"
     volumes:
      - /data:/data
      - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip
@@ -227,7 +227,7 @@ services:
     ports:
      - "64297:64297"
      - "127.0.0.1:64304:64304"
-    image: "ghcr.io/telekom-security/nginx:2006"
+    image: "dtagdevsec/nginx:2006"
     read_only: true
     volumes:
      - /data/nginx/cert/:/etc/nginx/cert/:ro
@@ -245,6 +245,6 @@ services:
      - spiderfoot_local
     ports:
      - "127.0.0.1:64303:8080"
-    image: "ghcr.io/telekom-security/spiderfoot:2006"
+    image: "dtagdevsec/spiderfoot:2006"
     volumes:
      - /data/spiderfoot/spiderfoot.db:/home/spiderfoot/spiderfoot.db
diff --git a/etc/compose/industrial.yml b/etc/compose/industrial.yml
index 8578c551..07df0f4a 100644
--- a/etc/compose/industrial.yml
+++ b/etc/compose/industrial.yml
@@ -48,7 +48,7 @@ services:
      - "21:21"
      - "44818:44818"
      - "47808:47808"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -70,7 +70,7 @@ services:
     ports:
 #     - "161:161"
      - "2404:2404"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -91,7 +91,7 @@ services:
      - conpot_local_guardian_ast
     ports:
      - "10001:10001"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -112,7 +112,7 @@ services:
      - conpot_local_ipmi
     ports:
      - "623:623"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -134,7 +134,7 @@ services:
     ports:
      - "1025:1025"
      - "50100:50100"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -151,7 +151,7 @@ services:
     ports:
      - "22:22"
      - "23:23"
-    image: "ghcr.io/telekom-security/cowrie:2006"
+    image: "dtagdevsec/cowrie:2006"
     read_only: true
     volumes:
      - /data/cowrie/downloads:/home/cowrie/cowrie/dl
@@ -170,7 +170,7 @@ services:
      - dicompot_local
     ports:
      - "11112:11112"
-    image: "ghcr.io/telekom-security/dicompot:2006"
+    image: "dtagdevsec/dicompot:2006"
     read_only: true
     volumes:
      - /data/dicompot/log:/var/log/dicompot
@@ -199,7 +199,7 @@ services:
     # - "3389:3389"
     # - "5432:5432"
      - "5900:5900"
-    image: "ghcr.io/telekom-security/heralding:2006"
+    image: "dtagdevsec/heralding:2006"
     read_only: true
     volumes:
      - /data/heralding/log:/var/log/heralding
@@ -212,7 +212,7 @@ services:
      - honeysap_local
     ports:
      - "3299:3299"
-    image: "ghcr.io/telekom-security/honeysap:2006"
+    image: "dtagdevsec/honeysap:2006"
     volumes:
      - /data/honeysap/log:/opt/honeysap/log
 
@@ -225,7 +225,7 @@ services:
     network_mode: "host"
     cap_add:
      - NET_ADMIN
-    image: "ghcr.io/telekom-security/honeytrap:2006"
+    image: "dtagdevsec/honeytrap:2006"
     read_only: true
     volumes:
      - /data/honeytrap/attacks:/opt/honeytrap/var/attacks
@@ -240,7 +240,7 @@ services:
      - medpot_local
     ports:
      - "2575:2575"
-    image: "ghcr.io/telekom-security/medpot:2006"
+    image: "dtagdevsec/medpot:2006"
     read_only: true
     volumes:
      - /data/medpot/log/:/var/log/medpot
@@ -261,7 +261,7 @@ services:
      - rdpy_local
     ports:
      - "3389:3389"
-    image: "ghcr.io/telekom-security/rdpy:2006"
+    image: "dtagdevsec/rdpy:2006"
     read_only: true
     volumes:
      - /data/rdpy/log:/var/log/rdpy
@@ -280,7 +280,7 @@ services:
      - NET_ADMIN
      - SYS_NICE
      - NET_RAW
-    image: "ghcr.io/telekom-security/fatt:2006"
+    image: "dtagdevsec/fatt:2006"
     volumes:
      - /data/fatt/log:/opt/fatt/log
 
@@ -289,7 +289,7 @@ services:
     container_name: p0f
     restart: always
     network_mode: "host"
-    image: "ghcr.io/telekom-security/p0f:2006"
+    image: "dtagdevsec/p0f:2006"
     read_only: true
     volumes:
      - /data/p0f/log:/var/log/p0f
@@ -306,7 +306,7 @@ services:
      - NET_ADMIN
      - SYS_NICE
      - NET_RAW
-    image: "ghcr.io/telekom-security/suricata:2006"
+    image: "dtagdevsec/suricata:2006"
     volumes:
      - /data/suricata/log:/var/log/suricata
 
@@ -323,7 +323,7 @@ services:
      - cyberchef_local
     ports:
      - "127.0.0.1:64299:8000"
-    image: "ghcr.io/telekom-security/cyberchef:2006"
+    image: "dtagdevsec/cyberchef:2006"
     read_only: true
 
 #### ELK
@@ -347,7 +347,7 @@ services:
     mem_limit: 4g
     ports:
      - "127.0.0.1:64298:9200"
-    image: "ghcr.io/telekom-security/elasticsearch:2006"
+    image: "dtagdevsec/elasticsearch:2006"
     volumes:
      - /data:/data
 
@@ -360,7 +360,7 @@ services:
         condition: service_healthy
     ports:
      - "127.0.0.1:64296:5601"
-    image: "ghcr.io/telekom-security/kibana:2006"
+    image: "dtagdevsec/kibana:2006"
 
 ## Logstash service
   logstash:
@@ -373,7 +373,7 @@ services:
         condition: service_healthy
     env_file:
      - /opt/tpot/etc/compose/elk_environment
-    image: "ghcr.io/telekom-security/logstash:2006"
+    image: "dtagdevsec/logstash:2006"
     volumes:
      - /data:/data
 
@@ -386,7 +386,7 @@ services:
         condition: service_healthy
     ports:
      - "127.0.0.1:64302:9100"
-    image: "ghcr.io/telekom-security/head:2006"
+    image: "dtagdevsec/head:2006"
     read_only: true
 
 # Ewsposter service
@@ -406,7 +406,7 @@ services:
      - EWS_HPFEEDS_FORMAT=json
     env_file:
      - /opt/tpot/etc/compose/elk_environment
-    image: "ghcr.io/telekom-security/ewsposter:2006"
+    image: "dtagdevsec/ewsposter:2006"
     volumes:
      - /data:/data
      - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip
@@ -434,7 +434,7 @@ services:
     ports:
      - "64297:64297"
      - "127.0.0.1:64304:64304"
-    image: "ghcr.io/telekom-security/nginx:2006"
+    image: "dtagdevsec/nginx:2006"
     read_only: true
     volumes:
      - /data/nginx/cert/:/etc/nginx/cert/:ro
@@ -452,6 +452,6 @@ services:
      - spiderfoot_local
     ports:
      - "127.0.0.1:64303:8080"
-    image: "ghcr.io/telekom-security/spiderfoot:2006"
+    image: "dtagdevsec/spiderfoot:2006"
     volumes:
      - /data/spiderfoot/spiderfoot.db:/home/spiderfoot/spiderfoot.db
diff --git a/etc/compose/medical.yml b/etc/compose/medical.yml
index 28f01195..9fad7fbb 100644
--- a/etc/compose/medical.yml
+++ b/etc/compose/medical.yml
@@ -26,7 +26,7 @@ services:
      - dicompot_local
     ports:
      - "11112:11112"
-    image: "ghcr.io/telekom-security/dicompot:2006"
+    image: "dtagdevsec/dicompot:2006"
     read_only: true
     volumes:
      - /data/dicompot/log:/var/log/dicompot
@@ -40,7 +40,7 @@ services:
      - medpot_local
     ports:
      - "2575:2575"
-    image: "ghcr.io/telekom-security/medpot:2006"
+    image: "dtagdevsec/medpot:2006"
     read_only: true
     volumes:
      - /data/medpot/log/:/var/log/medpot
@@ -58,7 +58,7 @@ services:
      - NET_ADMIN
      - SYS_NICE
      - NET_RAW
-    image: "ghcr.io/telekom-security/fatt:2006"
+    image: "dtagdevsec/fatt:2006"
     volumes:
      - /data/fatt/log:/opt/fatt/log
 
@@ -67,7 +67,7 @@ services:
     container_name: p0f
     restart: always
     network_mode: "host"
-    image: "ghcr.io/telekom-security/p0f:2006"
+    image: "dtagdevsec/p0f:2006"
     read_only: true
     volumes:
      - /data/p0f/log:/var/log/p0f
@@ -84,7 +84,7 @@ services:
      - NET_ADMIN
      - SYS_NICE
      - NET_RAW
-    image: "ghcr.io/telekom-security/suricata:2006"
+    image: "dtagdevsec/suricata:2006"
     volumes:
      - /data/suricata/log:/var/log/suricata
 
@@ -101,7 +101,7 @@ services:
      - cyberchef_local
     ports:
      - "127.0.0.1:64299:8000"
-    image: "ghcr.io/telekom-security/cyberchef:2006"
+    image: "dtagdevsec/cyberchef:2006"
     read_only: true
 
 #### ELK
@@ -125,7 +125,7 @@ services:
     mem_limit: 4g
     ports:
      - "127.0.0.1:64298:9200"
-    image: "ghcr.io/telekom-security/elasticsearch:2006"
+    image: "dtagdevsec/elasticsearch:2006"
     volumes:
      - /data:/data
 
@@ -138,7 +138,7 @@ services:
         condition: service_healthy
     ports:
      - "127.0.0.1:64296:5601"
-    image: "ghcr.io/telekom-security/kibana:2006"
+    image: "dtagdevsec/kibana:2006"
 
 ## Logstash service
   logstash:
@@ -151,7 +151,7 @@ services:
         condition: service_healthy
     env_file:
      - /opt/tpot/etc/compose/elk_environment
-    image: "ghcr.io/telekom-security/logstash:2006"
+    image: "dtagdevsec/logstash:2006"
     volumes:
      - /data:/data
 
@@ -164,7 +164,7 @@ services:
         condition: service_healthy
     ports:
      - "127.0.0.1:64302:9100"
-    image: "ghcr.io/telekom-security/head:2006"
+    image: "dtagdevsec/head:2006"
     read_only: true
 
 # Ewsposter service
@@ -184,7 +184,7 @@ services:
      - EWS_HPFEEDS_FORMAT=json
     env_file:
      - /opt/tpot/etc/compose/elk_environment
-    image: "ghcr.io/telekom-security/ewsposter:2006"
+    image: "dtagdevsec/ewsposter:2006"
     volumes:
      - /data:/data
      - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip
@@ -212,7 +212,7 @@ services:
     ports:
      - "64297:64297"
      - "127.0.0.1:64304:64304"
-    image: "ghcr.io/telekom-security/nginx:2006"
+    image: "dtagdevsec/nginx:2006"
     read_only: true
     volumes:
      - /data/nginx/cert/:/etc/nginx/cert/:ro
@@ -230,6 +230,6 @@ services:
      - spiderfoot_local
     ports:
      - "127.0.0.1:64303:8080"
-    image: "ghcr.io/telekom-security/spiderfoot:2006"
+    image: "dtagdevsec/spiderfoot:2006"
     volumes:
      - /data/spiderfoot/spiderfoot.db:/home/spiderfoot/spiderfoot.db
diff --git a/etc/compose/nextgen.yml b/etc/compose/nextgen.yml
index c2829659..80a7e7ae 100644
--- a/etc/compose/nextgen.yml
+++ b/etc/compose/nextgen.yml
@@ -40,7 +40,7 @@ services:
      - adbhoney_local
     ports:
      - "5555:5555"
-    image: "ghcr.io/telekom-security/adbhoney:2006"
+    image: "dtagdevsec/adbhoney:2006"
     read_only: true
     volumes:
      - /data/adbhoney/log:/opt/adbhoney/log
@@ -57,7 +57,7 @@ services:
     ports:
      - "5000:5000/udp"
      - "8443:8443"
-    image: "ghcr.io/telekom-security/ciscoasa:2006"
+    image: "dtagdevsec/ciscoasa:2006"
     read_only: true
     volumes:
      - /data/ciscoasa/log:/var/log/ciscoasa
@@ -70,7 +70,7 @@ services:
      - citrixhoneypot_local
     ports:
      - "443:443"
-    image: "ghcr.io/telekom-security/citrixhoneypot:2006"
+    image: "dtagdevsec/citrixhoneypot:2006"
     read_only: true
     volumes:
      - /data/citrixhoneypot/logs:/opt/citrixhoneypot/logs       
@@ -92,7 +92,7 @@ services:
     ports:
      - "161:161"
      - "2404:2404"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -113,7 +113,7 @@ services:
      - conpot_local_guardian_ast
     ports:
      - "10001:10001"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -134,7 +134,7 @@ services:
      - conpot_local_ipmi
     ports:
      - "623:623"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -156,7 +156,7 @@ services:
     ports:
      - "1025:1025"
      - "50100:50100"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -173,7 +173,7 @@ services:
     ports:
      - "22:22"
      - "23:23"
-    image: "ghcr.io/telekom-security/cowrie:2006"
+    image: "dtagdevsec/cowrie:2006"
     read_only: true
     volumes:
      - /data/cowrie/downloads:/home/cowrie/cowrie/dl
@@ -192,7 +192,7 @@ services:
      - dicompot_local
     ports:
      - "11112:11112"
-    image: "ghcr.io/telekom-security/dicompot:2006"
+    image: "dtagdevsec/dicompot:2006"
     read_only: true
     volumes:
      - /data/dicompot/log:/var/log/dicompot
@@ -223,7 +223,7 @@ services:
      - "5060:5060/udp"
      - "5061:5061"
      - "27017:27017"
-    image: "ghcr.io/telekom-security/dionaea:2006"
+    image: "dtagdevsec/dionaea:2006"
     read_only: true
     volumes:
      - /data/dionaea/roots/ftp:/opt/dionaea/var/dionaea/roots/ftp
@@ -243,7 +243,7 @@ services:
      - elasticpot_local
     ports:
      - "9200:9200"
-    image: "ghcr.io/telekom-security/elasticpot:2006"
+    image: "dtagdevsec/elasticpot:2006"
     read_only: true
     volumes:
      - /data/elasticpot/log:/opt/elasticpot/log
@@ -258,7 +258,7 @@ services:
     network_mode: "host"
     cap_add:
      - NET_ADMIN
-    image: "ghcr.io/telekom-security/glutton:2006"
+    image: "dtagdevsec/glutton:2006"
     read_only: true
     volumes:
      - /data/glutton/log:/var/log/glutton
@@ -288,7 +288,7 @@ services:
      - "1080:1080"
      - "5432:5432"
      - "5900:5900"
-    image: "ghcr.io/telekom-security/heralding:2006"
+    image: "dtagdevsec/heralding:2006"
     read_only: true
     volumes:
      - /data/heralding/log:/var/log/heralding
@@ -307,7 +307,7 @@ services:
      - "2324:2324"
      - "4096:4096"
     # - "9200:9200"
-    image: "ghcr.io/telekom-security/honeypy:2006"
+    image: "dtagdevsec/honeypy:2006"
     read_only: true
     volumes:
      - /data/honeypy/log:/opt/honeypy/log
@@ -320,7 +320,7 @@ services:
      - honeysap_local
     ports:
      - "3299:3299"
-    image: "ghcr.io/telekom-security/honeysap:2006"
+    image: "dtagdevsec/honeysap:2006"
     volumes:
      - /data/honeysap/log:/opt/honeysap/log
 
@@ -332,7 +332,7 @@ services:
      - ipphoney_local
     ports:
      - "631:631"
-    image: "ghcr.io/telekom-security/ipphoney:2006"
+    image: "dtagdevsec/ipphoney:2006"
     read_only: true
     volumes:
      - /data/ipphoney/log:/opt/ipphoney/log
@@ -351,7 +351,7 @@ services:
      - mailoney_local
     ports:
      - "25:25"
-    image: "ghcr.io/telekom-security/mailoney:2006"
+    image: "dtagdevsec/mailoney:2006"
     read_only: true
     volumes:
      - /data/mailoney/log:/opt/mailoney/logs
@@ -364,7 +364,7 @@ services:
      - medpot_local
     ports:
      - "2575:2575"
-    image: "ghcr.io/telekom-security/medpot:2006"
+    image: "dtagdevsec/medpot:2006"
     read_only: true
     volumes:
      - /data/medpot/log/:/var/log/medpot
@@ -385,7 +385,7 @@ services:
      - rdpy_local
     ports:
      - "3389:3389"
-    image: "ghcr.io/telekom-security/rdpy:2006"
+    image: "dtagdevsec/rdpy:2006"
     read_only: true
     volumes:
      - /data/rdpy/log:/var/log/rdpy
@@ -398,7 +398,7 @@ services:
     tty: true
     networks:
      - tanner_local
-    image: "ghcr.io/telekom-security/redis:2006"
+    image: "dtagdevsec/redis:2006"
     read_only: true
 
 ## PHP Sandbox service
@@ -408,7 +408,7 @@ services:
     tty: true
     networks:
      - tanner_local
-    image: "ghcr.io/telekom-security/phpox:2006"
+    image: "dtagdevsec/phpox:2006"
     read_only: true
 
 ## Tanner API Service
@@ -420,7 +420,7 @@ services:
     tty: true
     networks:
      - tanner_local
-    image: "ghcr.io/telekom-security/tanner:2006"
+    image: "dtagdevsec/tanner:2006"
     read_only: true
     volumes:
      - /data/tanner/log:/var/log/tanner
@@ -437,7 +437,7 @@ services:
 #    tty: true
 #    networks:
 #     - tanner_local
-#    image: "ghcr.io/telekom-security/tanner:2006"
+#    image: "dtagdevsec/tanner:2006"
 #    command: tannerweb
 #    read_only: true
 #    volumes:
@@ -454,7 +454,7 @@ services:
     tty: true
     networks:
      - tanner_local
-    image: "ghcr.io/telekom-security/tanner:2006"
+    image: "dtagdevsec/tanner:2006"
     command: tanner
     read_only: true
     volumes:
@@ -474,7 +474,7 @@ services:
      - tanner_local
     ports:
      - "80:80"
-    image: "ghcr.io/telekom-security/snare:2006"
+    image: "dtagdevsec/snare:2006"
     depends_on:
      - tanner
 
@@ -492,7 +492,7 @@ services:
      - NET_ADMIN
      - SYS_NICE
      - NET_RAW
-    image: "ghcr.io/telekom-security/fatt:2006"
+    image: "dtagdevsec/fatt:2006"
     volumes:
      - /data/fatt/log:/opt/fatt/log
 
@@ -501,7 +501,7 @@ services:
     container_name: p0f
     restart: always
     network_mode: "host"
-    image: "ghcr.io/telekom-security/p0f:2006"
+    image: "dtagdevsec/p0f:2006"
     read_only: true
     volumes:
      - /data/p0f/log:/var/log/p0f
@@ -518,7 +518,7 @@ services:
      - NET_ADMIN
      - SYS_NICE
      - NET_RAW
-    image: "ghcr.io/telekom-security/suricata:2006"
+    image: "dtagdevsec/suricata:2006"
     volumes:
      - /data/suricata/log:/var/log/suricata
 
@@ -535,7 +535,7 @@ services:
      - cyberchef_local
     ports:
      - "127.0.0.1:64299:8000"
-    image: "ghcr.io/telekom-security/cyberchef:2006"
+    image: "dtagdevsec/cyberchef:2006"
     read_only: true
 
 #### ELK
@@ -559,7 +559,7 @@ services:
     mem_limit: 4g
     ports:
      - "127.0.0.1:64298:9200"
-    image: "ghcr.io/telekom-security/elasticsearch:2006"
+    image: "dtagdevsec/elasticsearch:2006"
     volumes:
      - /data:/data
 
@@ -572,7 +572,7 @@ services:
         condition: service_healthy
     ports:
      - "127.0.0.1:64296:5601"
-    image: "ghcr.io/telekom-security/kibana:2006"
+    image: "dtagdevsec/kibana:2006"
 
 ## Logstash service
   logstash:
@@ -585,7 +585,7 @@ services:
         condition: service_healthy
     env_file:
      - /opt/tpot/etc/compose/elk_environment
-    image: "ghcr.io/telekom-security/logstash:2006"
+    image: "dtagdevsec/logstash:2006"
     volumes:
      - /data:/data
 
@@ -598,7 +598,7 @@ services:
         condition: service_healthy
     ports:
      - "127.0.0.1:64302:9100"
-    image: "ghcr.io/telekom-security/head:2006"
+    image: "dtagdevsec/head:2006"
     read_only: true
 
 # Ewsposter service
@@ -618,7 +618,7 @@ services:
      - EWS_HPFEEDS_FORMAT=json
     env_file:
      - /opt/tpot/etc/compose/elk_environment
-    image: "ghcr.io/telekom-security/ewsposter:2006"
+    image: "dtagdevsec/ewsposter:2006"
     volumes:
      - /data:/data
      - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip
@@ -646,7 +646,7 @@ services:
     ports:
      - "64297:64297"
      - "127.0.0.1:64304:64304"
-    image: "ghcr.io/telekom-security/nginx:2006"
+    image: "dtagdevsec/nginx:2006"
     read_only: true
     volumes:
      - /data/nginx/cert/:/etc/nginx/cert/:ro
@@ -664,6 +664,6 @@ services:
      - spiderfoot_local
     ports:
      - "127.0.0.1:64303:8080"
-    image: "ghcr.io/telekom-security/spiderfoot:2006"
+    image: "dtagdevsec/spiderfoot:2006"
     volumes:
      - /data/spiderfoot/spiderfoot.db:/home/spiderfoot/spiderfoot.db
diff --git a/etc/compose/sensor.yml b/etc/compose/sensor.yml
index be7313e4..31fb5c8b 100644
--- a/etc/compose/sensor.yml
+++ b/etc/compose/sensor.yml
@@ -37,7 +37,7 @@ services:
      - adbhoney_local
     ports:
      - "5555:5555"
-    image: "ghcr.io/telekom-security/adbhoney:2006"
+    image: "dtagdevsec/adbhoney:2006"
     read_only: true
     volumes:
      - /data/adbhoney/log:/opt/adbhoney/log
@@ -54,7 +54,7 @@ services:
     ports:
      - "5000:5000/udp"
      - "8443:8443"
-    image: "ghcr.io/telekom-security/ciscoasa:2006"
+    image: "dtagdevsec/ciscoasa:2006"
     read_only: true
     volumes:
      - /data/ciscoasa/log:/var/log/ciscoasa
@@ -67,7 +67,7 @@ services:
      - citrixhoneypot_local
     ports:
      - "443:443"
-    image: "ghcr.io/telekom-security/citrixhoneypot:2006"
+    image: "dtagdevsec/citrixhoneypot:2006"
     read_only: true
     volumes:
      - /data/citrixhoneypot/logs:/opt/citrixhoneypot/logs
@@ -89,7 +89,7 @@ services:
     ports:
      - "161:161"
      - "2404:2404"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -110,7 +110,7 @@ services:
      - conpot_local_guardian_ast
     ports:
      - "10001:10001"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -131,7 +131,7 @@ services:
      - conpot_local_ipmi
     ports:
      - "623:623"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -153,7 +153,7 @@ services:
     ports:
      - "1025:1025"
      - "50100:50100"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -170,7 +170,7 @@ services:
     ports:
      - "22:22"
      - "23:23"
-    image: "ghcr.io/telekom-security/cowrie:2006"
+    image: "dtagdevsec/cowrie:2006"
     read_only: true
     volumes:
      - /data/cowrie/downloads:/home/cowrie/cowrie/dl
@@ -189,7 +189,7 @@ services:
      - dicompot_local
     ports:
      - "11112:11112"
-    image: "ghcr.io/telekom-security/dicompot:2006"
+    image: "dtagdevsec/dicompot:2006"
     read_only: true
     volumes:
      - /data/dicompot/log:/var/log/dicompot
@@ -220,7 +220,7 @@ services:
      - "5060:5060/udp"
      - "5061:5061"
      - "27017:27017"
-    image: "ghcr.io/telekom-security/dionaea:2006"
+    image: "dtagdevsec/dionaea:2006"
     read_only: true
     volumes:
      - /data/dionaea/roots/ftp:/opt/dionaea/var/dionaea/roots/ftp
@@ -240,7 +240,7 @@ services:
      - elasticpot_local
     ports:
      - "9200:9200"
-    image: "ghcr.io/telekom-security/elasticpot:2006"
+    image: "dtagdevsec/elasticpot:2006"
     read_only: true
     volumes:
      - /data/elasticpot/log:/opt/elasticpot/log
@@ -269,7 +269,7 @@ services:
      - "1080:1080"
      - "5432:5432"
      - "5900:5900"
-    image: "ghcr.io/telekom-security/heralding:2006"
+    image: "dtagdevsec/heralding:2006"
     read_only: true
     volumes:
      - /data/heralding/log:/var/log/heralding
@@ -288,7 +288,7 @@ services:
      - "2324:2324"
      - "4096:4096"
     # - "9200:9200"
-    image: "ghcr.io/telekom-security/honeypy:2006"
+    image: "dtagdevsec/honeypy:2006"
     read_only: true
     volumes:
      - /data/honeypy/log:/opt/honeypy/log
@@ -301,7 +301,7 @@ services:
      - honeysap_local
     ports:
      - "3299:3299"
-    image: "ghcr.io/telekom-security/honeysap:2006"
+    image: "dtagdevsec/honeysap:2006"
     volumes:
      - /data/honeysap/log:/opt/honeysap/log
 
@@ -314,7 +314,7 @@ services:
     network_mode: "host"
     cap_add:
      - NET_ADMIN
-    image: "ghcr.io/telekom-security/honeytrap:2006"
+    image: "dtagdevsec/honeytrap:2006"
     read_only: true
     volumes:
      - /data/honeytrap/attacks:/opt/honeytrap/var/attacks
@@ -335,7 +335,7 @@ services:
      - mailoney_local
     ports:
      - "25:25"
-    image: "ghcr.io/telekom-security/mailoney:2006"
+    image: "dtagdevsec/mailoney:2006"
     read_only: true
     volumes:
      - /data/mailoney/log:/opt/mailoney/logs
@@ -348,7 +348,7 @@ services:
      - medpot_local
     ports:
      - "2575:2575"
-    image: "ghcr.io/telekom-security/medpot:2006"
+    image: "dtagdevsec/medpot:2006"
     read_only: true
     volumes:
      - /data/medpot/log/:/var/log/medpot
@@ -369,7 +369,7 @@ services:
      - rdpy_local
     ports:
      - "3389:3389"
-    image: "ghcr.io/telekom-security/rdpy:2006"
+    image: "dtagdevsec/rdpy:2006"
     read_only: true
     volumes:
      - /data/rdpy/log:/var/log/rdpy
@@ -382,7 +382,7 @@ services:
     tty: true
     networks:
      - tanner_local
-    image: "ghcr.io/telekom-security/redis:2006"
+    image: "dtagdevsec/redis:2006"
     read_only: true
 
 ## PHP Sandbox service
@@ -392,7 +392,7 @@ services:
     tty: true
     networks:
      - tanner_local
-    image: "ghcr.io/telekom-security/phpox:2006"
+    image: "dtagdevsec/phpox:2006"
     read_only: true
 
 ## Tanner API Service
@@ -404,7 +404,7 @@ services:
     tty: true
     networks:
      - tanner_local
-    image: "ghcr.io/telekom-security/tanner:2006"
+    image: "dtagdevsec/tanner:2006"
     read_only: true
     volumes:
      - /data/tanner/log:/var/log/tanner
@@ -421,7 +421,7 @@ services:
 #    tty: true
 #    networks:
 #     - tanner_local
-#    image: "ghcr.io/telekom-security/tanner:2006"
+#    image: "dtagdevsec/tanner:2006"
 #    command: tannerweb
 #    read_only: true
 #    volumes:
@@ -438,7 +438,7 @@ services:
     tty: true
     networks:
      - tanner_local
-    image: "ghcr.io/telekom-security/tanner:2006"
+    image: "dtagdevsec/tanner:2006"
     command: tanner
     read_only: true
     volumes:
@@ -458,7 +458,7 @@ services:
      - tanner_local
     ports:
      - "80:80"
-    image: "ghcr.io/telekom-security/snare:2006"
+    image: "dtagdevsec/snare:2006"
     depends_on:
      - tanner
 
@@ -476,7 +476,7 @@ services:
      - NET_ADMIN
      - SYS_NICE
      - NET_RAW
-    image: "ghcr.io/telekom-security/fatt:2006"
+    image: "dtagdevsec/fatt:2006"
     volumes:
      - /data/fatt/log:/opt/fatt/log
 
@@ -485,7 +485,7 @@ services:
     container_name: p0f
     restart: always
     network_mode: "host"
-    image: "ghcr.io/telekom-security/p0f:2006"
+    image: "dtagdevsec/p0f:2006"
     read_only: true
     volumes:
      - /data/p0f/log:/var/log/p0f
@@ -502,7 +502,7 @@ services:
      - NET_ADMIN
      - SYS_NICE
      - NET_RAW
-    image: "ghcr.io/telekom-security/suricata:2006"
+    image: "dtagdevsec/suricata:2006"
     volumes:
      - /data/suricata/log:/var/log/suricata
 
@@ -528,7 +528,7 @@ services:
      - EWS_HPFEEDS_FORMAT=json
     env_file:
      - /opt/tpot/etc/compose/elk_environment
-    image: "ghcr.io/telekom-security/ewsposter:2006"
+    image: "dtagdevsec/ewsposter:2006"
     volumes:
      - /data:/data
      - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip
diff --git a/etc/compose/standard.yml b/etc/compose/standard.yml
index ce53972d..2543da4d 100644
--- a/etc/compose/standard.yml
+++ b/etc/compose/standard.yml
@@ -37,7 +37,7 @@ services:
      - adbhoney_local
     ports:
      - "5555:5555"
-    image: "ghcr.io/telekom-security/adbhoney:2006"
+    image: "dtagdevsec/adbhoney:2006"
     read_only: true
     volumes:
      - /data/adbhoney/log:/opt/adbhoney/log
@@ -53,7 +53,7 @@ services:
     ports:
      - "5000:5000/udp"
      - "8443:8443"
-    image: "ghcr.io/telekom-security/ciscoasa:2006"
+    image: "dtagdevsec/ciscoasa:2006"
     read_only: true
     volumes:
      - /data/ciscoasa/log:/var/log/ciscoasa
@@ -66,7 +66,7 @@ services:
      - citrixhoneypot_local
     ports:
      - "443:443"
-    image: "ghcr.io/telekom-security/citrixhoneypot:2006"
+    image: "dtagdevsec/citrixhoneypot:2006"
     read_only: true
     volumes:
      - /data/citrixhoneypot/logs:/opt/citrixhoneypot/logs
@@ -88,7 +88,7 @@ services:
     ports:
      - "161:161"
      - "2404:2404"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -109,7 +109,7 @@ services:
      - conpot_local_guardian_ast
     ports:
      - "10001:10001"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -130,7 +130,7 @@ services:
      - conpot_local_ipmi
     ports:
      - "623:623"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -152,7 +152,7 @@ services:
     ports:
      - "1025:1025"
      - "50100:50100"
-    image: "ghcr.io/telekom-security/conpot:2006"
+    image: "dtagdevsec/conpot:2006"
     read_only: true
     volumes:
      - /data/conpot/log:/var/log/conpot
@@ -169,7 +169,7 @@ services:
     ports:
      - "22:22"
      - "23:23"
-    image: "ghcr.io/telekom-security/cowrie:2006"
+    image: "dtagdevsec/cowrie:2006"
     read_only: true
     volumes:
      - /data/cowrie/downloads:/home/cowrie/cowrie/dl
@@ -188,7 +188,7 @@ services:
      - dicompot_local
     ports:
      - "11112:11112"
-    image: "ghcr.io/telekom-security/dicompot:2006"
+    image: "dtagdevsec/dicompot:2006"
     read_only: true
     volumes:
      - /data/dicompot/log:/var/log/dicompot
@@ -219,7 +219,7 @@ services:
      - "5060:5060/udp"
      - "5061:5061"
      - "27017:27017"
-    image: "ghcr.io/telekom-security/dionaea:2006"
+    image: "dtagdevsec/dionaea:2006"
     read_only: true
     volumes:
      - /data/dionaea/roots/ftp:/opt/dionaea/var/dionaea/roots/ftp
@@ -239,7 +239,7 @@ services:
      - elasticpot_local
     ports:
      - "9200:9200"
-    image: "ghcr.io/telekom-security/elasticpot:2006"
+    image: "dtagdevsec/elasticpot:2006"
     read_only: true
     volumes:
      - /data/elasticpot/log:/opt/elasticpot/log
@@ -268,7 +268,7 @@ services:
      - "1080:1080"
      - "5432:5432"
      - "5900:5900"
-    image: "ghcr.io/telekom-security/heralding:2006"
+    image: "dtagdevsec/heralding:2006"
     read_only: true
     volumes:
      - /data/heralding/log:/var/log/heralding
@@ -281,7 +281,7 @@ services:
      - honeysap_local
     ports:
      - "3299:3299"
-    image: "ghcr.io/telekom-security/honeysap:2006"
+    image: "dtagdevsec/honeysap:2006"
     volumes:
      - /data/honeysap/log:/opt/honeysap/log
 
@@ -294,7 +294,7 @@ services:
     network_mode: "host"
     cap_add:
      - NET_ADMIN
-    image: "ghcr.io/telekom-security/honeytrap:2006"
+    image: "dtagdevsec/honeytrap:2006"
     read_only: true
     volumes:
      - /data/honeytrap/attacks:/opt/honeytrap/var/attacks
@@ -315,7 +315,7 @@ services:
      - mailoney_local
     ports:
      - "25:25"
-    image: "ghcr.io/telekom-security/mailoney:2006"
+    image: "dtagdevsec/mailoney:2006"
     read_only: true
     volumes:
      - /data/mailoney/log:/opt/mailoney/logs
@@ -328,7 +328,7 @@ services:
      - medpot_local
     ports:
      - "2575:2575"
-    image: "ghcr.io/telekom-security/medpot:2006"
+    image: "dtagdevsec/medpot:2006"
     read_only: true
     volumes:
      - /data/medpot/log/:/var/log/medpot
@@ -349,7 +349,7 @@ services:
      - rdpy_local
     ports:
      - "3389:3389"
-    image: "ghcr.io/telekom-security/rdpy:2006"
+    image: "dtagdevsec/rdpy:2006"
     read_only: true
     volumes:
      - /data/rdpy/log:/var/log/rdpy
@@ -362,7 +362,7 @@ services:
     tty: true
     networks:
      - tanner_local
-    image: "ghcr.io/telekom-security/redis:2006"
+    image: "dtagdevsec/redis:2006"
     read_only: true
 
 ## PHP Sandbox service
@@ -372,7 +372,7 @@ services:
     tty: true
     networks:
      - tanner_local
-    image: "ghcr.io/telekom-security/phpox:2006"
+    image: "dtagdevsec/phpox:2006"
     read_only: true
 
 ## Tanner API Service
@@ -384,7 +384,7 @@ services:
     tty: true
     networks:
      - tanner_local
-    image: "ghcr.io/telekom-security/tanner:2006"
+    image: "dtagdevsec/tanner:2006"
     read_only: true
     volumes:
      - /data/tanner/log:/var/log/tanner
@@ -401,7 +401,7 @@ services:
 #    tty: true
 #    networks:
 #     - tanner_local
-#    image: "ghcr.io/telekom-security/tanner:2006"
+#    image: "dtagdevsec/tanner:2006"
 #    command: tannerweb
 #    read_only: true
 #    volumes:
@@ -418,7 +418,7 @@ services:
     tty: true
     networks:
      - tanner_local
-    image: "ghcr.io/telekom-security/tanner:2006"
+    image: "dtagdevsec/tanner:2006"
     command: tanner
     read_only: true
     volumes:
@@ -438,7 +438,7 @@ services:
      - tanner_local
     ports:
      - "80:80"
-    image: "ghcr.io/telekom-security/snare:2006"
+    image: "dtagdevsec/snare:2006"
     depends_on:
      - tanner
 
@@ -456,7 +456,7 @@ services:
      - NET_ADMIN
      - SYS_NICE
      - NET_RAW
-    image: "ghcr.io/telekom-security/fatt:2006"
+    image: "dtagdevsec/fatt:2006"
     volumes:
      - /data/fatt/log:/opt/fatt/log
 
@@ -465,7 +465,7 @@ services:
     container_name: p0f
     restart: always
     network_mode: "host"
-    image: "ghcr.io/telekom-security/p0f:2006"
+    image: "dtagdevsec/p0f:2006"
     read_only: true
     volumes:
      - /data/p0f/log:/var/log/p0f
@@ -482,7 +482,7 @@ services:
      - NET_ADMIN
      - SYS_NICE
      - NET_RAW
-    image: "ghcr.io/telekom-security/suricata:2006"
+    image: "dtagdevsec/suricata:2006"
     volumes:
      - /data/suricata/log:/var/log/suricata
 
@@ -499,7 +499,7 @@ services:
      - cyberchef_local
     ports:
      - "127.0.0.1:64299:8000"
-    image: "ghcr.io/telekom-security/cyberchef:2006"
+    image: "dtagdevsec/cyberchef:2006"
     read_only: true
 
 #### ELK
@@ -523,7 +523,7 @@ services:
     mem_limit: 4g
     ports:
      - "127.0.0.1:64298:9200"
-    image: "ghcr.io/telekom-security/elasticsearch:2006"
+    image: "dtagdevsec/elasticsearch:2006"
     volumes:
      - /data:/data
 
@@ -536,7 +536,7 @@ services:
         condition: service_healthy
     ports:
      - "127.0.0.1:64296:5601"
-    image: "ghcr.io/telekom-security/kibana:2006"
+    image: "dtagdevsec/kibana:2006"
 
 ## Logstash service
   logstash:
@@ -549,7 +549,7 @@ services:
         condition: service_healthy
     env_file:
      - /opt/tpot/etc/compose/elk_environment
-    image: "ghcr.io/telekom-security/logstash:2006"
+    image: "dtagdevsec/logstash:2006"
     volumes:
      - /data:/data
 
@@ -562,7 +562,7 @@ services:
         condition: service_healthy
     ports:
      - "127.0.0.1:64302:9100"
-    image: "ghcr.io/telekom-security/head:2006"
+    image: "dtagdevsec/head:2006"
     read_only: true
 
 # Ewsposter service
@@ -582,7 +582,7 @@ services:
      - EWS_HPFEEDS_FORMAT=json
     env_file:
      - /opt/tpot/etc/compose/elk_environment
-    image: "ghcr.io/telekom-security/ewsposter:2006"
+    image: "dtagdevsec/ewsposter:2006"
     volumes:
      - /data:/data
      - /data/ews/conf/ews.ip:/opt/ewsposter/ews.ip
@@ -610,7 +610,7 @@ services:
     ports:
      - "64297:64297"
      - "127.0.0.1:64304:64304"
-    image: "ghcr.io/telekom-security/nginx:2006"
+    image: "dtagdevsec/nginx:2006"
     read_only: true
     volumes:
      - /data/nginx/cert/:/etc/nginx/cert/:ro
@@ -628,6 +628,6 @@ services:
      - spiderfoot_local
     ports:
      - "127.0.0.1:64303:8080"
-    image: "ghcr.io/telekom-security/spiderfoot:2006"
+    image: "dtagdevsec/spiderfoot:2006"
     volumes:
      - /data/spiderfoot/spiderfoot.db:/home/spiderfoot/spiderfoot.db
diff --git a/iso/installer/install.sh b/iso/installer/install.sh
index a1b91c32..62777ea2 100755
--- a/iso/installer/install.sh
+++ b/iso/installer/install.sh
@@ -21,8 +21,8 @@ myTPOTCOMPOSE="/opt/tpot/etc/tpot.yml"
 myLSB_STABLE_SUPPORTED="stretch buster"
 myLSB_TESTING_SUPPORTED="stable"
 myREMOTESITES="https://hub.docker.com https://github.com https://pypi.python.org https://debian.org https://listbot.sicherheitstacho.eu"
-myPREINSTALLPACKAGES="aria2 apache2-utils cracklib-runtime curl dialog figlet fuse grc libcrack2 libpq-dev lsb-release netselect-apt net-tools software-properties-common toilet"
-myINSTALLPACKAGES="aria2 apache2-utils apparmor apt-transport-https aufs-tools bash-completion build-essential ca-certificates cgroupfs-mount cockpit cockpit-docker console-setup console-setup-linux cracklib-runtime curl debconf-utils dialog dnsutils docker.io docker-compose ethtool fail2ban figlet genisoimage git glances grc haveged html2text htop iptables iw jq kbd libcrack2 libltdl7 libpam-google-authenticator man mosh multitail netselect-apt net-tools npm ntp openssh-server openssl pass pigz prips software-properties-common syslinux psmisc pv python3-pip toilet unattended-upgrades unzip vim wget wireless-tools wpasupplicant"
+myPREINSTALLPACKAGES="aria2 apache2-utils cracklib-runtime curl dialog figlet fuse grc libcrack2 libpq-dev lsb-release net-tools software-properties-common toilet"
+myINSTALLPACKAGES="aria2 apache2-utils apparmor apt-transport-https aufs-tools bash-completion build-essential ca-certificates cgroupfs-mount cockpit cockpit-docker console-setup console-setup-linux cracklib-runtime curl debconf-utils dialog dnsutils docker.io docker-compose ethtool fail2ban figlet genisoimage git glances grc haveged html2text htop iptables iw jq kbd libcrack2 libltdl7 libpam-google-authenticator man mosh multitail net-tools npm ntp openssh-server openssl pass pigz prips software-properties-common syslinux psmisc pv python3-pip toilet unattended-upgrades unzip vim wget wireless-tools wpasupplicant"
 myINFO="\
 ###########################################
 ### T-Pot Installer for Debian (Stable) ###
@@ -290,21 +290,6 @@ function fuCHECKNET {
 # Install T-Pot dependencies
 function fuGET_DEPS {
   export DEBIAN_FRONTEND=noninteractive
-  # Determine fastest mirror
-  echo
-  echo "### Determine fastest mirror for your location."
-  echo
-  netselect-apt -n -a amd64 stable && cp sources.list /etc/apt/
-  mySOURCESCHECK=$(cat /etc/apt/sources.list | grep -c stable)
-  if [ "$mySOURCESCHECK" == "0" ]
-    then
-      echo "### Automatic mirror selection failed, using main mirror."
-      # Point to Debian (stable)
-tee /etc/apt/sources.list <<EOF
-deb http://deb.debian.org/debian stable main contrib non-free
-deb-src http://deb.debian.org/debian stable main contrib non-free
-EOF
-  fi
   echo
   echo "### Getting update information."
   echo
diff --git a/iso/preseed/tpot.seed b/iso/preseed/tpot.seed
index 4a8262d1..6b88721d 100755
--- a/iso/preseed/tpot.seed
+++ b/iso/preseed/tpot.seed
@@ -109,7 +109,7 @@ tasksel tasksel/first multiselect ssh-server
 ########################
 ### Package Installation
 ########################
-d-i pkgsel/include string apache2-utils cracklib-runtime curl dialog figlet git grc libcrack2 libpq-dev lsb-release netselect-apt net-tools software-properties-common toilet
+d-i pkgsel/include string apache2-utils cracklib-runtime curl dialog figlet git grc libcrack2 libpq-dev lsb-release net-tools software-properties-common toilet
 popularity-contest popularity-contest/participate boolean false
 
 #################
diff --git a/update.sh b/update.sh
index c76f20bc..cff90da8 100755
--- a/update.sh
+++ b/update.sh
@@ -183,7 +183,7 @@ function fuUPDATER () {
 export DEBIAN_FRONTEND=noninteractive
 echo "### Installing apt-fast"
 /bin/bash -c "$(curl -sL https://raw.githubusercontent.com/ilikenwf/apt-fast/master/quick-install.sh)"
-local myPACKAGES="aria2 apache2-utils apparmor apt-transport-https aufs-tools bash-completion build-essential ca-certificates cgroupfs-mount cockpit cockpit-docker console-setup console-setup-linux cracklib-runtime curl debconf-utils dialog dnsutils docker.io docker-compose ethtool fail2ban figlet genisoimage git glances grc haveged html2text htop iptables iw jq kbd libcrack2 libltdl7 libpam-google-authenticator man mosh multitail netselect-apt net-tools npm ntp openssh-server openssl pass pigz prips software-properties-common syslinux psmisc pv python3-elasticsearch-curator python3-pip toilet unattended-upgrades unzip vim wget wireless-tools wpasupplicant"
+local myPACKAGES="aria2 apache2-utils apparmor apt-transport-https aufs-tools bash-completion build-essential ca-certificates cgroupfs-mount cockpit cockpit-docker console-setup console-setup-linux cracklib-runtime curl debconf-utils dialog dnsutils docker.io docker-compose ethtool fail2ban figlet genisoimage git glances grc haveged html2text htop iptables iw jq kbd libcrack2 libltdl7 libpam-google-authenticator man mosh multitail net-tools npm ntp openssh-server openssl pass pigz prips software-properties-common syslinux psmisc pv python3-elasticsearch-curator python3-pip toilet unattended-upgrades unzip vim wget wireless-tools wpasupplicant"
 # Remove purge in the future
 echo "### Removing repository based install of elasticsearch-curator"
 apt-get purge elasticsearch-curator -y