IndicatorPublished 9 Nov 2026

Attacker url observed in the wild: https://api.ipify.org (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2021-41773

Indicators of compromise

URLs 1

OffSeq Mirage — an attacker payload URL, observed 2026-11-09..2026-11-09, 6× (CVE-2021-41773)

https://api.ipify.org

Description

The URL https://api.ipify.org has been observed in attacker activity linked to CVE-2021-41773. This URL was seen six times on 2026-11-09 as part of attacker payloads involving ingress tool transfer (T1105) techniques. The activity originated from attacker infrastructure in Great Britain. The URL is associated with exploitation attempts or tool downloads related to the referenced CVE.

Impact

The presence of this URL in attacker payloads suggests it is used as a tool download or callback endpoint in attacks exploiting CVE-2021-41773. While the URL itself is not a vulnerability, its use indicates active exploitation attempts or attacker infrastructure communication. No direct exploit code or confirmed in-the-wild exploitation is reported for this indicator, but it is linked to a known vulnerability.

Defensive guidance

Block and monitor traffic to https://api.ipify.org in proxy, web, and WAF logs to detect potential exploitation attempts related to CVE-2021-41773. There is no direct patch or fix related to this URL, but monitoring and blocking this indicator can help reduce risk. Investigate any requests to this URL as potential malicious activity.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

URLs 1

Description

AI analysisMachine-generated, updated 9 Nov 2026, 17:19 UTC

MITRE ATT&CK techniques1 from threat tags

References

Community reviews

Related threats