Attacker url observed in the wild: [email protected] (OffSeq Mirage)

The OffSeq Mirage threat intelligence platform observed an attacker URL '[email protected]' being used as an out-of-band callback or command-and-control endpoint in the wild. This URL was seen 7 times over a period of approximately two weeks in mid-2026. The observed attacker technique corresponds to MITRE ATT&CK T1071, indicating use of application layer protocols for command and control. The source infrastructure was located in the US. This indicator is intended to aid defenders in identifying and blocking malicious communications associated with this threat actor activity.

The presence of this URL as a command-and-control endpoint indicates potential unauthorized remote control or data exfiltration activity by attackers using application layer protocols. While no active exploits or specific payloads are detailed, communication with this URL could facilitate attacker control over compromised systems or data leakage.

Defenders should block network communications to the URL '[email protected]' and monitor proxy, web, and WAF logs for any requests to this endpoint. There is no patch or fix applicable as this is an indicator of compromise rather than a software vulnerability. Implementing network-level blocking and alerting on this indicator is the recommended mitigation.