Attacker url observed in the wild: http://chaomoinguoi.duckdns.org:8080/dlr.sh (OffSeq Mirage)

OffSeq Mirage honeypot sensors detected an attacker URL used in the wild for ingress tool transfer (technique T1105). The URL http://chaomoinguoi.duckdns.org:8080/dlr.sh was observed 12 times on 2026-11-09 originating from attacker infrastructure in Singapore. This URL is associated with attacker payloads such as tool downloads or callbacks. Organizations are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.

• mirage.offseq.com (opens in a new tab)

• Attacker url observed in the wild: https://github.com (OffSeq Mirage)Indicator2026-11-09
• Attacker url observed in the wild: https://api.ipify.org (OffSeq Mirage)Indicator2026-11-09
• Attacker url observed in the wild: https://cdn.876553.xyz/Q1fc8a9OCb7AsC6f/dl/01b981d8-71fe-… (OffSeq Mirage)Indicator2026-11-09
• Attacker url observed in the wild: https://raw.githubusercontent.com/nightagents/nightshell/… (OffSeq Mirage)Indicator2026-11-08
• Attacker url observed in the wild: http://phubotnet.duckdns.org/main_x86 (OffSeq Mirage)Indicator2026-11-05