Payloads observatory

Malware our honeypots were told to download.

When an exploit payload carries a wget/curl one-liner, we fetch the file in a sandboxed collector, hash it, and check it against VirusTotal (uploading samples VT has not seen). 101 files so far, 81 flagged malicious. URLs are shown in Safe-IOC form; hashes link to the VT report, and both the staging host and the IPs seen delivering each sample pivot into the per-IP report.