IndicatorPublished 5 Nov 2026

Attacker url observed in the wild: http://phubotnet.duckdns.org/main_mips (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

URLs 1

OffSeq Mirage — an attacker payload URL, observed 2026-11-05..2026-11-06, 2×

http://phubotnet.duckdns.org/main_mips

Description

OffSeq Mirage honeypot sensors detected an attacker URL (http://phubotnet.duckdns.org/main_mips) twice between November 5 and 6, 2026. The URL is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was observed originating from attacker infrastructure in South Korea. This URL was used in attacker payloads, including tool downloads, callbacks, or exploitation targets. Organizations are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.

Impact

The URL is used by attackers to transfer tools or payloads, which could facilitate further compromise if accessed. While no specific exploit or vulnerability is detailed, the presence of this URL in network traffic indicates potential malicious activity and risk of infection or unauthorized access.

Defensive guidance

Block access to the URL http://phubotnet.duckdns.org/main_mips at network perimeter controls such as firewalls, proxies, and web application firewalls. Monitor logs for any requests to this URL to detect potential compromise or attacker activity. Investigate any such requests to determine if systems have been impacted.

Summary

The OffSeq Mirage threat intelligence platform observed the URL http://phubotnet.duckdns.org/main_mips in attacker activity on two occasions over a two-day period in November 2026. The activity corresponds to MITRE ATT&CK technique T1105, indicating the URL was used for ingress tool transfer, such as downloading malicious tools or callbacks. The source infrastructure was identified in South Korea. This URL is part of attacker payloads and represents an indicator of compromise. No direct exploit or vulnerability is described, but the URL is linked to attacker operations.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

URLs 1

Description

AI analysisMachine-generated, updated 6 Nov 2026, 13:50 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats