IndicatorPublished 07/28/2026

Attacker url observed in the wild: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA… (OffSeq Mirage)

Source OffSeq Mirage

Description

A URL identified as an attacker callback or command-and-control (C2) endpoint was observed in the wild by OffSeq Mirage honeypot sensors on 2026-07-28. The URL was seen four times during attacker activity and is associated with technique T1657. The attacker infrastructure was located in Switzerland (CH). This indicator should be blocked and monitored, and organizations are advised to search their proxy, web, and WAF logs for any requests to this URL.

Summary

OffSeq Mirage honeypot sensors detected an attacker URL used as a callback or C2 endpoint, observed twice on 2026-07-28. The activity corresponds to MITRE ATT&CK technique T1657, which involves out-of-band channels for command and control. The attacker infrastructure was traced to Switzerland. This indicator is intended for blocking and monitoring to detect potential malicious activity. No direct exploit or vulnerability details are provided.

Impact

The URL serves as a command-and-control or callback endpoint, which could facilitate attacker communications or control over compromised systems. While no direct exploit or vulnerability is described, the presence of this URL in network logs may indicate malicious activity or compromise.

Defensive guidance

Block and monitor the identified URL in proxy, web, and WAF logs. Search existing logs for any requests to this URL to identify potential compromise or attacker activity. No patch or software fix applies as this is an indicator of compromise rather than a software vulnerability.

Indicators of compromise

URLs 2

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOffSeq Mirage — an attacker callback / C2 URL, observed 2026-07-28..2026-07-28, 2×
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaOffSeq Mirage — an attacker callback / C2 URL, observed 2026-07-28..2026-07-28, 4×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:32:50 UTC

Technical details

Indicators of compromise

URLs 2

References

Related threats