DESCRIPTION LAST UPDATED: 2023-12-06
DEFAULT SEVERITY LEVEL: INFO
This report contains information about DDoS attack targets observed by honeypot drones. These drones emulate malware bot infected machines and can listen to commands given to those bots. These commands include the C2 issuing the command and target information, malware family, protocol being used for C2 and attack destination as well as various attack parameters.
The dst_ip is the IP of the attack victim, the src_ip below is the C2 IP issuing the commands. If you are getting this report, it means an IP (dst_ip) that was targeted was located on your network or constituency (attack destination).
The activity reported is typically related to Mirai like bots. The naming convention and description is consistent with the Mirai source code published.
This report has its sister version that contains the same information but filtered by src_ip (address of the C2 issuing commands): the Honeypot DDoS Event Report.
You can learn more on the report in our Honeypot DDoS Target Events Report tutorial.
You can learn more on our reports in general in our Overview of Free Public Benefit Shadowserver Reports presentation, which also explains example Use Cases.
You can view HTTP DDoS Target events on our Dashboard.
This report was enabled as part of the European Union HaDEA CEF VARIoT project.
Severity levels are described here.
File name: event4_honeypot_ddos_target
