Attacker url observed in the wild: http://botnet.code.wf/Sakura.sh (OffSeq Mirage)

OffSeq Mirage honeypot sensors observed this attacker URL 2 time(s) in attacker activity between 2026-11-11 and 2026-11-11. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in NL. This URL was observed in attacker payloads (tool download, callback, or exploitation target). Block and monitor it, and search your proxy/web/WAF logs for requests to it.

• mirage.offseq.com (opens in a new tab)

• Attacker url observed in the wild: http://vagos.cc/Sakura.sh (OffSeq Mirage)Indicator2026-11-11
• Attacker url observed in the wild: https://sites.google.com/view/systemctls/anDUsn (OffSeq Mirage)Indicator2026-11-11
• Attacker url observed in the wild: http://chaomoinguoi.duckdns.org:8080/dlr.sh (OffSeq Mirage)Indicator2026-11-09
• Attacker url observed in the wild: https://github.com (OffSeq Mirage)Indicator2026-11-09
• Attacker url observed in the wild: https://api.ipify.org (OffSeq Mirage)Indicator2026-11-09