Reverse Shell C2 Callback to 62.171.185.97 via HTTP Ports with Wget/1.18 /pwned

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•3

This rule monitors for network connections to a specific remote IP (62.171.185.97) associated with suspicious activity. It flags connections involving specific high-risk ports, the use of Wget/1.18 for user agents, or access to the '/pwned' URL path, which are common indicators of automated attack tools or post-exploitation activity.