IndicatorPublished 08/22/2026

Attacker url observed in the wild: da4sifsupagbfj848efgoki53kaum7rnc.oast.online (OffSeq Mirage)

Source OffSeq Mirage

Description

The OffSeq Mirage honeypot sensors detected an attacker-controlled URL used as a command-and-control (C2) or out-of-band callback endpoint. This URL was observed twice on August 22, 2026, originating from attacker infrastructure in Turkey. The activity involved the use of the T1071 technique, which relates to application layer protocol communication. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.

Summary

OffSeq Mirage honeypot sensors observed the URL da4sifsupagbfj848efgoki53kaum7rnc.oast.online being used as an attacker callback or command-and-control endpoint on August 22, 2026. The activity employed the MITRE ATT&CK technique T1071 (Application Layer Protocol) and originated from infrastructure located in Turkey. This URL serves as an out-of-band communication channel for attacker operations, indicating potential C2 or data exfiltration activity. The detection is based on honeypot telemetry rather than a specific software vulnerability or exploit.

Impact

The presence of this URL indicates active attacker infrastructure used for command-and-control or callback purposes. While no direct exploit or vulnerability is described, communication with this URL could facilitate attacker control or data exfiltration. No known exploits or malware samples are associated with this indicator at this time.

Defensive guidance

Block the URL da4sifsupagbfj848efgoki53kaum7rnc.oast.online at network perimeter controls such as firewalls, proxies, and web application firewalls. Monitor logs from proxy, web servers, and WAFs for any requests to this URL to detect potential compromise or ongoing attacker communication. No patch or software update is applicable as this is an indicator of attacker infrastructure rather than a software vulnerability.

Indicators of compromise

URLs 1

da4sifsupagbfj848efgoki53kaum7rnc.oast.onlineOffSeq Mirage — an attacker callback / C2 URL, observed 2026-08-22..2026-08-22, 2×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:30:51 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats