IndicatorPublished 08/26/2026

Attacker url observed in the wild: da7h7gkupag53ubtlfng6iwxxod7xrzrk.oast.live (OffSeq Mirage)

Source OffSeq Mirage

Description

The URL da7h7gkupag53ubtlfng6iwxxod7xrzrk.oast.live was observed in the wild as an attacker callback or command-and-control (C2) endpoint. It was detected twice on August 26, 2026, by OffSeq Mirage honeypot sensors. The activity involved the use of the T1071 technique, which relates to application layer protocol communications. The attacker infrastructure was identified as originating from Turkey (TR).

Summary

OffSeq Mirage honeypot sensors detected the URL da7h7gkupag53ubtlfng6iwxxod7xrzrk.oast.live being used as an out-of-band callback or C2 endpoint on August 26, 2026. The observed technique corresponds to MITRE ATT&CK T1071, indicating use of application layer protocols for command and control. The URL was seen twice in attacker activity and is linked to infrastructure in Turkey. This URL is an indicator of compromise (IOC) rather than a vulnerability or exploit itself.

Impact

This URL serves as a command-and-control or callback endpoint used by attackers, which could facilitate remote control or data exfiltration if contacted by compromised systems. Detection of this URL in network traffic may indicate active or attempted malicious activity involving application layer protocol communications. There is no direct vulnerability or exploit associated with the URL itself.

Defensive guidance

Block and monitor traffic to the URL da7h7gkupag53ubtlfng6iwxxod7xrzrk.oast.live. Search proxy, web, and WAF logs for any requests to this URL to identify potential compromise or attacker activity. No patch or fix is applicable as this is an indicator of attacker infrastructure, not a software vulnerability.

Indicators of compromise

URLs 1

da7h7gkupag53ubtlfng6iwxxod7xrzrk.oast.liveOffSeq Mirage — an attacker callback / C2 URL, observed 2026-08-26..2026-08-26, 2×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:30:48 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats