IndicatorPublished 07/28/2026

Attacker url observed in the wild: 999999999999999999999999999999999999999999999999999999999… (OffSeq Mirage)

Source OffSeq Mirage

Description

An attacker URL was observed in the wild by OffSeq Mirage honeypot sensors on July 28, 2026. This URL was used as an out-of-band callback or command-and-control (C2) endpoint, associated with technique T1657. The attacker infrastructure was identified in Switzerland (CH). The URL was seen twice during the observation period. No known exploits or threat actors are linked to this URL at this time.

Summary

OffSeq Mirage honeypot sensors detected an attacker URL used as a callback or command-and-control endpoint on July 28, 2026. The URL was observed twice and is linked to the MITRE ATT&CK technique T1657, which involves out-of-band communication channels. The attacker infrastructure was located in Switzerland. This indicator is intended to support detection and blocking of malicious traffic related to this URL.

Impact

The URL serves as a command-and-control or callback endpoint, which could facilitate attacker communication with compromised systems. While no active exploitation or known threat actors are currently associated, the presence of this URL in network traffic may indicate malicious activity or compromise.

Defensive guidance

Block and monitor the identified URL in network defenses such as proxy servers, web gateways, and web application firewalls (WAFs). Search logs for any requests to this URL to identify potential compromise or attacker activity. No official patch or fix is applicable as this is an indicator of compromise rather than a software vulnerability.

Indicators of compromise

URLs 1

99999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999OffSeq Mirage — an attacker callback / C2 URL, observed 2026-07-28..2026-07-28, 2×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:32:53 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats