IndicatorPublished 10/24/2026

Attacker url observed in the wild: http://play.nopixel-rp.ir/ (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

URLs 1

OffSeq Mirage — an attacker payload URL, observed 2026-10-24..2026-10-24, 2×

http://play.nopixel-rp.ir/

Description

The URL http://play.nopixel-rp.ir/ was observed twice in attacker activity on 2026-10-24 by OffSeq Mirage honeypot sensors. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating its use in attacker payloads such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified as originating from Great Britain. This URL serves as an indicator of compromise (IOC) and should be blocked and monitored in network defenses.

Impact

The URL is used in attacker payloads and may facilitate ingress tool transfer, potentially enabling attackers to download tools or establish callbacks. However, there is no evidence of active exploitation or specific vulnerabilities tied to this URL. The impact is limited to its role as an infrastructure element in attacker operations.

Defensive guidance

Block access to the URL http://play.nopixel-rp.ir/ in network security controls such as proxies, web filters, and WAFs. Monitor logs for any requests to this URL to detect potential attacker activity. No patch or software fix is applicable as this is an attacker infrastructure indicator. Follow standard incident response procedures if this URL is observed in your environment.

MITRE ATT&CK techniques

T1105Ingress Tool Transfer · Command and Control (opens in a new tab)

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

URLs 1

Description

AI analysisMachine-generated, updated 10/24/2026, 17:06:44 UTC

Technical details

MITRE ATT&CK techniques

References

Community reviews

Related threats