Attacker url observed in the wild: [email protected] (OffSeq Mirage)

The OffSeq Mirage threat intelligence platform observed the URL '[email protected]' being used as a callback or C2 endpoint in attacker operations. This URL was detected 17 times over a three-week period in mid-2026. The attackers employed the MITRE ATT&CK technique T1071, which involves using application layer protocols for command and control. The infrastructure linked to this activity was identified in Brazil and the United States. This indicator serves as a network-based artifact for defenders to detect potential attacker communications.

The presence of this URL in network traffic indicates potential attacker command-and-control activity, which could facilitate remote control or data exfiltration by threat actors. While no direct exploit or malware is reported, the URL's use as a C2 endpoint represents a security risk if communications to it are successful.

Block and monitor network traffic to and from the URL '[email protected]'. Search proxy, web, and WAF logs for any requests to this URL to identify potential compromise or attacker activity. There is no patch or fix applicable as this is an indicator of compromise rather than a software vulnerability.