IndicatorPublished 10/21/2026

Attacker url observed in the wild: aws.oast.online (OffSeq Mirage)

Source OffSeq Mirage

Description

The URL aws.oast.online was observed in attacker activity as a callback or command-and-control (C2) endpoint. It was detected by OffSeq Mirage honeypot sensors on 2026-10-21, with four occurrences noted. The activity involved the use of the T1071 technique, which relates to application layer protocol communications. The attacker infrastructure was identified as being located in Germany. This URL is associated with malicious out-of-band communications and should be blocked and monitored in network defenses.

Summary

OffSeq Mirage honeypot sensors detected the URL aws.oast.online being used as an attacker callback or command-and-control endpoint on 2026-10-21. The observed technique was T1071, indicating use of application layer protocols for communication. The attacker infrastructure was traced to Germany. This URL is an indicator of compromise linked to malicious activity involving out-of-band callbacks or C2 communications. No specific software vulnerability or exploit code is described.

Impact

The presence of this URL in network traffic indicates potential malicious command-and-control activity, which could facilitate attacker control or data exfiltration. While no direct exploit or vulnerability is described, communication with this URL suggests compromise or ongoing attacker operations. Detection and blocking of this URL can prevent further attacker communications.

Defensive guidance

Block the URL aws.oast.online at network perimeter controls such as firewalls, proxies, and web application firewalls. Monitor proxy, web, and WAF logs for any requests to this URL to detect potential compromise. No patch or software fix is applicable as this is an indicator of attacker infrastructure rather than a software vulnerability.

Indicators of compromise

URLs 1

aws.oast.onlineOffSeq Mirage — an attacker callback / C2 URL, observed 2026-10-21..2026-10-21, 4×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:30:57 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats