IndicatorPublished 5 Nov 2026

Attacker url observed in the wild: http://phubotnet.duckdns.org/main_x86 (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

URLs 1

OffSeq Mirage — an attacker payload URL, observed 2026-11-05..2026-11-06, 2×

http://phubotnet.duckdns.org/main_x86

Description

The URL http://phubotnet.duckdns.org/main_x86 was observed in attacker activity by OffSeq Mirage honeypot sensors on two occasions between 2026-11-05 and 2026-11-06. This URL is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen as part of attacker payloads, such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified as originating from South Korea (KR). Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.

Impact

The presence of this URL in attacker payloads suggests it is used to transfer malicious tools or payloads to compromised systems, potentially enabling further attacker actions. However, no specific exploit or vulnerability is described, and no known exploits in the wild are reported. The impact is primarily related to the risk of malware or tools being downloaded from this URL if accessed.

Defensive guidance

Organizations should block access to http://phubotnet.duckdns.org/main_x86 at network boundaries such as proxies, web gateways, and WAFs. They should also search their logs for any requests to this URL to detect potential compromise.

Summary

OffSeq Mirage honeypot sensors detected the attacker URL http://phubotnet.duckdns.org/main_x86 twice during 2026-11-05 to 2026-11-06. The URL is linked to the T1105 technique, which involves ingress tool transfer, indicating it is used for downloading attacker tools or callbacks. The attacker infrastructure was traced to South Korea. This URL is part of observed attacker payloads and should be treated as an indicator of compromise. No direct exploit or vulnerability details are provided, only the presence of the URL in attacker activity.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

URLs 1

Description

AI analysisMachine-generated, updated 6 Nov 2026, 13:50 UTC

MITRE ATT&CK techniques1 from threat tags

References

Community reviews

Related threats