I have my serve set up with AbuseIPDB so I can keep a log of all suspicious request and hacking attempts for my honeypot machine. I noticed an IP that sent a GET request to port 80.
18.104.22.168 - - [07/Jan/2021:12:07:20 -0500] "GET / HTTP/1.1" 200 326 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36"
I had a look at the other requests and noticed the IP with attempting to connect to telnet ports, typical behavior of an infected host. Why did this IP send a request to / on port 80? How does this help the botnet grow?
I'm not interested in preventing this as these connections occur on a honeypot machine, I'm curious as to why they happen in the first place.