IndicatorPublished 08/22/2026

Attacker url observed in the wild: da4ms7supagd531da040xszuj79z5wgss.oast.site (OffSeq Mirage)

Source OffSeq Mirage

Description

An attacker-controlled URL (da4ms7supagd531da040xszuj79z5wgss.oast.site) was observed in the wild on 2026-08-22 by OffSeq Mirage honeypot sensors. This URL was used as an out-of-band callback or command-and-control (C2) endpoint employing the T1071 technique (Application Layer Protocol). The activity was seen originating from attacker infrastructure in Turkey. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.

Summary

OffSeq Mirage honeypot sensors detected an attacker URL used as a callback or C2 endpoint twice on 2026-08-22. The observed technique corresponds to MITRE ATT&CK T1071, which involves communication over application layer protocols. The URL is associated with attacker infrastructure located in Turkey. This indicator represents a malicious endpoint used in attacker operations rather than a software vulnerability or exploit code.

Impact

The presence of this URL in network traffic indicates potential attacker command-and-control activity or data exfiltration attempts using application layer protocols. While no active exploit or vulnerability is described, communication with this URL could enable attackers to control compromised systems or receive stolen data.

Defensive guidance

Block the URL da4ms7supagd531da040xszuj79z5wgss.oast.site at network perimeter controls such as firewalls, proxies, and web application firewalls (WAFs). Search logs for any connections to this URL to identify potential compromise or ongoing attacker activity. There is no patch or software fix applicable as this is an attacker infrastructure indicator.

Indicators of compromise

URLs 1

da4ms7supagd531da040xszuj79z5wgss.oast.siteOffSeq Mirage — an attacker callback / C2 URL, observed 2026-08-22..2026-08-22, 2×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:30:54 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats