IndicatorPublished 10/17/2026Updated 10/19/2026

Attacker url observed in the wild: db9jehfrr4d9u7gicscgajwjz1tmfxd5m.oast.site (OffSeq Mirage)

Source OffSeq Mirage

Description

A URL associated with attacker activity was observed multiple times between 2026-10-17 and 2026-10-19. This URL was used as an out-of-band callback or command-and-control (C2) endpoint, employing the T1071 technique (Application Layer Protocol). The attacker infrastructure was located in the Netherlands. Security teams are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.

Summary

OffSeq Mirage honeypot sensors detected the URL db9jehfrr4d9u7gicscgajwjz1tmfxd5m.oast.site being used four times in attacker activity over a three-day period. The URL served as an out-of-band callback or command-and-control endpoint, leveraging the MITRE ATT&CK technique T1071, which involves communication over application layer protocols. The attacker infrastructure was identified in the Netherlands. This indicator is intended to help defenders identify and block malicious communications related to this threat.

Impact

The URL functions as a command-and-control or callback endpoint for attacker infrastructure, potentially enabling remote control or data exfiltration. No direct exploit or vulnerability is described. The presence of this URL in network logs indicates possible attacker activity or compromise.

Defensive guidance

Block and monitor the URL db9jehfrr4d9u7gicscgajwjz1tmfxd5m.oast.site on network perimeter devices such as firewalls, proxies, and web application firewalls (WAFs). Search existing logs for any requests to this URL to identify potential compromise or attacker communication. There is no patch or fix applicable as this is an indicator of compromise rather than a software vulnerability.

Indicators of compromise

URLs 1

db9jehfrr4d9u7gicscgajwjz1tmfxd5m.oast.siteOffSeq Mirage — an attacker callback / C2 URL, observed 2026-10-17..2026-10-19, 4×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:17:56 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats