IndicatorPublished 08/28/2026

Attacker url observed in the wild: da8ue2kupagblkmed22g71kjyejxromzd.oast.pro (OffSeq Mirage)

Source OffSeq Mirage

Description

The URL da8ue2kupagblkmed22g71kjyejxromzd.oast.pro was observed in attacker activity as an out-of-band callback or command-and-control endpoint. This URL was detected twice on 2026-08-28 by OffSeq Mirage honeypot sensors. The observed technique corresponds to T1071 (Application Layer Protocol). The attacker infrastructure was located in Turkey (TR).

Summary

OffSeq Mirage honeypot sensors detected the URL da8ue2kupagblkmed22g71kjyejxromzd.oast.pro being used as a callback or command-and-control (C2) endpoint in attacker activity on 2026-08-28. The activity employed the MITRE ATT&CK technique T1071, which involves using application layer protocols for command and control. The infrastructure associated with this URL was identified as originating from Turkey. This URL serves as an indicator of compromise (IOC) for monitoring and blocking to detect potential malicious communications.

Impact

The URL functions as a command-and-control or callback endpoint used by attackers, which could facilitate remote control or data exfiltration if contacted by compromised systems. No direct exploitation or active attacks are reported beyond its observation as an IOC. The presence of this URL in network logs may indicate compromise or attacker activity.

Defensive guidance

Block the URL da8ue2kupagblkmed22g71kjyejxromzd.oast.pro at network perimeter controls such as firewalls, proxies, and web application firewalls (WAFs). Monitor proxy, web, and WAF logs for any requests to this URL to detect potential attacker activity. There is no patch or fix applicable as this is an indicator of attacker infrastructure rather than a software vulnerability.

Indicators of compromise

URLs 1

da8ue2kupagblkmed22g71kjyejxromzd.oast.proOffSeq Mirage — an attacker callback / C2 URL, observed 2026-08-28..2026-08-28, 2×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:18:02 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats