Analyzing the Rondodox Botnet from a DShield Sensor

This post was written as part of my internship with SANS Internet Storm Center. Through November 20 and November 21, 2025, automated vulnerability scanning was identified against the DShield Honeypot from 192[.]159[.]99[.]95 with the goal of gaining remote code execution against potential victims. These probing and scanning activities stood out as interesting as some POST requests were observed…