Attacker url observed in the wild: http://coolcams.duckdns.org/s?t=hikvision_36260 (OffSeq Mirage)

A URL associated with attacker activity was observed in the wild between 2026-11-08 and 2026-11-13. The URL, http://coolcams.duckdns.org/s?t=hikvision_36260, was linked to the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen in attacker payloads such as tool downloads, callbacks, or exploitation targets. The activity was detected by OffSeq Mirage honeypot sensors and originated from attacker infrastructure located in Mexico and Turkey. No specific affected software versions or products are identified.

• mirage.offseq.com (opens in a new tab)

• Attacker url observed in the wild: http://vagos.cc/Sakura.sh (OffSeq Mirage)Indicator2026-11-11
• Attacker url observed in the wild: http://botnet.code.wf/Sakura.sh (OffSeq Mirage)Indicator2026-11-11
• Attacker url observed in the wild: https://sites.google.com/view/systemctls/anDUsn (OffSeq Mirage)Indicator2026-11-11
• Attacker url observed in the wild: http://chaomoinguoi.duckdns.org:8080/dlr.sh (OffSeq Mirage)Indicator2026-11-09
• Attacker url observed in the wild: https://github.com (OffSeq Mirage)Indicator2026-11-09