This activity was found and reported by BACS student Adam Thorman\u00a0as part of one of his assignments which I posted his final paper [1<\/a>] last week. This activity appeared to only have occurred on the 19 Feb 2026 where at least 2 sensors detected on the same day by DShield sensor in the cowrie logs an echo command that included: “MAGIC_PAYLOAD_KILLER_HERE_OR_LEAVE_EMPTY_iranbot_was_here<\/span>“. My DShield sensor captured activity from source IP 64.89.161.198<\/a> between 30 Jan – 22 Feb 2026 that included portscans, a successful login via Telnet (TCP\/23) and web access that included all the activity listed below captured by the DShield sensor (cowrie, webhoneypot & iptables logs).<\/p>\n Bot successfully logged in twice into the sensor on the 15 and 19 Feb 2026 via Telnet. The bot activity of interest was a shell script uploaded on the 19 Feb 2026 in an attempt to exploit IoTs and 64-bit Linux systems.<\/p>\n Using Adam [1] grep command, I found in my logs the same script uploaded to the DShield sensor:<\/p>\n ubuntu@vps-711a413c:~\/downloads$ sudo cat f1c0e109640d154246d27ff05074365740e994f142ef9846634bec7b18e3b715<\/span><\/p>\n Script Content<\/strong><\/span> Cowrie Log<\/strong><\/span><\/p>\n Indicators<\/strong><\/span><\/p>\n 64.89.161.198 If you detected the same type of activity, we also appreciate feedback and suggestions about what tool might be used to perform these scans. Please use our contact<\/a> page to provide feedback.\u00a0<\/p>\n [1] https:\/\/isc.sans.edu\/diary\/32788 ———– (c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n \t![\"\"](\"https:\/\/i0.wp.com\/isc.sans.edu\/diaryimages\/images\/64_89_161_198_pic1.png?ssl=1\")
<\/p>\n
\n![\"\"](\"https:\/\/i0.wp.com\/isc.sans.edu\/diaryimages\/images\/64_89_161_198_pic2.png?ssl=1\")
<\/p>\n![\"\"](\"https:\/\/i0.wp.com\/isc.sans.edu\/diaryimages\/images\/64_89_161_198_pic3.png?ssl=1\")
<\/p>\n
\n188.214.30.5
\nhttp[:]\/\/188.214.30.5\/r.sh
\nf1c0e109640d154246d27ff05074365740e994f142ef9846634bec7b18e3b715<\/p>\n
\n[2] https:\/\/www.virustotal.com\/gui\/file\/f1c0e109640d154246d27ff05074365740e994f142ef9846634bec7b18e3b715\/detection
\n[3] https:\/\/www.linkedin.com\/in\/adam-thorman\/
\n[4] https:\/\/isc.sans.edu\/ipinfo\/64.89.161.198
\n[5] https:\/\/isc.sans.edu\/weblogs\/sourcedetails.html?date=2026-02-19&ip=64.89.161.198
\n[6] https:\/\/isc.sans.edu\/ipinfo\/188.214.30.5
\n[7] https:\/\/www.shodan.io\/host\/64.89.161.198
\n[8] https:\/\/www.virustotal.com\/gui\/ip-address\/64.89.161.198\/detection
\n[9] https:\/\/github.com\/DShield-ISC\/dshield
\n[10] https:\/\/github.com\/bruneaug\/DShield-SIEM\/tree\/main<\/p>\n
\nGuy Bruneau IPSS Inc.<\/a>
\nMy GitHub Page<\/a>
\nTwitter: GuyBruneau<\/a>
\ngbruneau at isc dot sans dot edu<\/p>\n
\n
<\/BR><\/p>\n