Cowrie SSH honeypot observations of Mirai/Gafgyt activity, September - October 2026

Evidence package from a Cowrie SSH honeypot, documenting September - October 2026 activity involving 45.198.224.34 and related source IPs. The archive contains an evidence brief and 13 timestamped screenshots. It records captured payload hashes, two versions of the snypesh.sh loader, and differences observed between them. The September and October observations both involve 45.198.224.34. The records do not establish a common operator or a connection to PHP2Shell.CC BY 4.0 applies to my original analysis. Third party interfaces and captured third party material retain their respective rights.