IndicatorPublished 08/19/2026

Attacker url observed in the wild: 37455255 (OffSeq Mirage)

Source OffSeq Mirage

Description

An attacker URL identified as '37455255' was observed in the wild by OffSeq Mirage honeypot sensors between August 19 and August 20, 2026. This URL was used as an out-of-band callback or command-and-control (C2) endpoint associated with the MITRE ATT&CK technique T1071.004. The attacker infrastructure was located in Kenya (KN). The URL was seen 5 times during this period. No direct exploit or vulnerability is described, but the URL is an indicator of malicious activity.

Summary

OffSeq Mirage honeypot sensors detected an attacker URL '37455255' used as a callback or C2 endpoint in attacker activity over two days in August 2026. The activity corresponds to MITRE ATT&CK technique T1071.004, which involves application layer protocol communication for command and control. The source infrastructure was identified in Kenya. This URL serves as an indicator of compromise (IOC) rather than a vulnerability or exploit itself.

Impact

The presence of this URL indicates active attacker infrastructure used for command and control communications. While no direct exploit or vulnerability is reported, organizations receiving traffic to or from this URL may be subject to malicious control or data exfiltration attempts. Detection and blocking of this URL can help prevent attacker communications.

Defensive guidance

Block and monitor the URL '37455255' in network defenses such as proxies, web gateways, and web application firewalls. Search logs for any requests to this URL to identify potential compromise or attacker activity. There is no patch or fix applicable as this is an indicator of attacker infrastructure, not a software vulnerability.

Indicators of compromise

URLs 1

37455255OffSeq Mirage — an attacker callback / C2 URL, observed 2026-08-19..2026-08-20, 5×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:31:03 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats