Attacker url observed in the wild: chinamobile.com (OffSeq Mirage)

OffSeq Mirage honeypot sensors detected the URL chinamobile.com being used as an out-of-band callback or command-and-control endpoint in attacker activity 32 times over a three-week period in mid-2026. The observed technique corresponds to T1071, which involves application layer protocol communication. The attacker infrastructure was traced to France. This URL is an indicator of compromise (IOC) associated with attacker operations and should be monitored and blocked to prevent potential malicious communications.

The presence of chinamobile.com as a callback or C2 URL indicates potential attacker control or data exfiltration channels. While no specific exploits or payloads are detailed, communication with this URL could facilitate attacker command execution or data transfer, posing a risk to affected networks if contacted.

Block the URL chinamobile.com at network perimeter controls such as firewalls, proxies, and web application firewalls (WAFs). Search existing proxy, web, and WAF logs for any requests to this URL to identify potential compromise or attacker activity. Monitor for any future attempts to communicate with this domain. No patch or vendor fix is applicable as this is an indicator of attacker infrastructure rather than a software vulnerability.