IndicatorPublished 10/21/2026

Attacker url observed in the wild: alibaba.oast.pro (OffSeq Mirage)

Source OffSeq Mirage

Description

The URL alibaba.oast.pro was observed in the wild as an attacker-controlled callback or command-and-control (C2) endpoint. It was detected twice on 2026-10-21 by OffSeq Mirage honeypot sensors using the T1071 technique (Application Layer Protocol). The attacker infrastructure was identified as located in Germany. This URL is associated with malicious activity and should be blocked and monitored in network defenses.

Summary

OffSeq Mirage honeypot sensors detected the URL alibaba.oast.pro being used as an out-of-band callback or command-and-control endpoint in attacker activity on 2026-10-21. The observed technique corresponds to MITRE ATT&CK T1071, which involves using application layer protocols for command and control. The attacker infrastructure was traced to Germany. This URL represents an indicator of compromise (IOC) linked to attacker infrastructure and activity.

Impact

This URL serves as a command-and-control or callback endpoint, indicating potential ongoing or attempted malicious communications from compromised systems or attacker tools. While no specific exploit or malware is detailed, presence of this URL in network traffic may indicate compromise or active attacker operations.

Defensive guidance

Block the URL alibaba.oast.pro at network perimeter controls such as firewalls, proxies, and web application firewalls (WAF). Search proxy, web, and WAF logs for any requests to this URL to identify potential compromise or attacker activity. Monitor for further related indicators from trusted threat intelligence sources.

Indicators of compromise

URLs 1

alibaba.oast.proOffSeq Mirage — an attacker callback / C2 URL, observed 2026-10-21..2026-10-21, 2×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:31:00 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats