IndicatorPublished 10/14/2026

Attacker url observed in the wild: db7gmmcupag28tv6hn00opfunut1saqiz.oast.fun (OffSeq Mirage)

Source OffSeq Mirage

Description

An attacker URL 'db7gmmcupag28tv6hn00opfunut1saqiz.oast.fun' was observed in the wild on 2026-10-14 by OffSeq Mirage honeypot sensors. The URL was used as an out-of-band callback or command-and-control (C2) endpoint associated with the ATT&CK technique T1071 (Application Layer Protocol). The attacker infrastructure was identified as originating from Turkey (TR). This URL was seen twice during the observation period. No specific software versions are affected as this is an indicator of compromise rather than a software vulnerability.

Summary

OffSeq Mirage honeypot sensors detected the attacker-controlled URL 'db7gmmcupag28tv6hn00opfunut1saqiz.oast.fun' twice on 2026-10-14. The URL serves as an out-of-band callback or command-and-control endpoint, leveraging the MITRE ATT&CK technique T1071, which involves application layer protocol communication. The attacker infrastructure was traced to Turkey. This indicator is intended for detection and blocking to prevent potential malicious callbacks or C2 communications.

Impact

The presence of this URL in network traffic may indicate active attacker communication or command-and-control activity. While no direct exploit or vulnerability is described, allowing traffic to this URL could facilitate attacker control or data exfiltration. No known exploits or active campaigns are reported in the input data.

Defensive guidance

Block and monitor network traffic to the URL 'db7gmmcupag28tv6hn00opfunut1saqiz.oast.fun'. Search proxy, web, and WAF logs for any requests to this domain to identify potential compromise or attacker activity. No patch or software fix is applicable as this is an indicator of attacker infrastructure. Follow organizational procedures for handling indicators of compromise.

Indicators of compromise

URLs 1

db7gmmcupag28tv6hn00opfunut1saqiz.oast.funOffSeq Mirage — an attacker callback / C2 URL, observed 2026-10-14..2026-10-14, 2×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:17:59 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats