Attacker url observed in the wild: http://phubotnet.duckdns.org/main_sh4 (OffSeq Mirage)

The URL http://phubotnet.duckdns.org/main_sh4 was observed in attacker activity between 2026-11-05 and 2026-11-06 by OffSeq Mirage honeypot sensors. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in South Korea. The URL has been used in attacker payloads such as tool downloads, callbacks, or exploitation targets. Defenders are advised to block and monitor this URL and search proxy, web, and WAF logs for any requests to it.

• mirage.offseq.com (opens in a new tab)

• Attacker url observed in the wild: http://phubotnet.duckdns.org/main_x86 (OffSeq Mirage)Indicator2026-11-05
• Attacker url observed in the wild: http://phubotnet.duckdns.org/main_mips (OffSeq Mirage)Indicator2026-11-05
• Attacker url observed in the wild: https://raw.githubusercontent.com/president32/uploader2/m… (OffSeq Mirage)Indicator2026-11-05
• Attacker url observed in the wild: https://github.com/xmrig/xmrig/releases/download/v6.22.2/… (OffSeq Mirage)Indicator2026-11-04
• Attacker url observed in the wild: oast.pro (OffSeq Mirage)Indicator2026-11-02