Attacker url observed in the wild: dbj8e4hhhsec5qnnue906fprppz3d315h.oast.live (OffSeq Mirage)

A URL associated with attacker activity was observed in the wild by OffSeq Mirage honeypot sensors on 2026-11-01. The URL, dbj8e4hhhsec5qnnue906fprppz3d315h.oast.live, was used as an out-of-band callback or command-and-control (C2) endpoint employing the T1071 technique (Application Layer Protocol). The attacker infrastructure was identified in Brazil. Security teams are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.

• mirage.offseq.com (opens in a new tab)

• Attacker url observed in the wild: https://dpaste.org/qAr9p/raw (OffSeq Mirage)Indicator2026-10-31
• Attacker url observed in the wild: https://dpaste.org/BXu7Y/raw (OffSeq Mirage)Indicator2026-10-31
• Attacker url observed in the wild: https://pentest-tools.com/ (OffSeq Mirage)Indicator2026-10-26
• Attacker url observed in the wild: https://pastebin.com/raw/QGrjKCsR (OffSeq Mirage)Indicator2026-10-25
• Attacker url observed in the wild: http://play.nopixel-rp.ir/ (OffSeq Mirage)Indicator2026-10-24