IndicatorPublished 08/28/2026

Attacker url observed in the wild: da8rq4kupagb10cam570pe86ued56935j.oast.live (OffSeq Mirage)

Source OffSeq Mirage

Description

The OffSeq Mirage honeypot sensors detected an attacker-controlled URL used as a command-and-control (C2) or out-of-band callback endpoint. This URL was observed twice on 2026-08-28 and is associated with the T1071 technique (Application Layer Protocol). The attacker infrastructure was identified in Turkey (TR). Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.

Summary

OffSeq Mirage honeypot sensors observed the URL da8rq4kupagb10cam570pe86ued56935j.oast.live being used as an attacker callback or command-and-control endpoint. The activity was recorded twice on 2026-08-28 and involved the MITRE ATT&CK technique T1071, which relates to application layer protocol communication. The attacker infrastructure was traced to Turkey. This URL serves as an out-of-band communication channel for attackers to control compromised systems or exfiltrate data.

Impact

The presence of this URL in network logs may indicate communication with attacker infrastructure, potentially enabling command-and-control operations or data exfiltration. Detection of this URL in network traffic suggests possible compromise or ongoing attacker activity. However, no specific exploit or malware is directly associated with this indicator at this time.

Defensive guidance

Block the URL da8rq4kupagb10cam570pe86ued56935j.oast.live at network perimeter controls such as firewalls, proxies, and web application firewalls. Monitor network and proxy logs for any requests to this URL to detect potential attacker activity. Investigate any such connections promptly. There is no patch or fix applicable as this is an attacker infrastructure indicator, not a software vulnerability.

Indicators of compromise

URLs 1

da8rq4kupagb10cam570pe86ued56935j.oast.liveOffSeq Mirage — an attacker callback / C2 URL, observed 2026-08-28..2026-08-28, 2×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:18:05 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats