IndicatorPublished 9 Nov 2026

Attacker url observed in the wild: https://cdn.876553.xyz/Q1fc8a9OCb7AsC6f/dl/01b981d8-71fe-… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

URLs 1

OffSeq Mirage — an attacker payload URL, observed 2026-11-09..2026-11-09, 2×

https://cdn.876553.xyz/Q1fc8a9OCb7AsC6f/dl/01b981d8-71fe-4578-b5d4-ed2b47f4eba5

Description

OffSeq Mirage honeypot sensors detected an attacker URL used in the wild on 2026-11-09. The URL was observed twice and is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The attacker infrastructure was identified as being located in Hong Kong. This URL is linked to attacker payloads such as tool downloads, callbacks, or exploitation targets. Organizations are advised to block and monitor this URL and search their proxy, web, or WAF logs for any requests to it.

Impact

The presence of this URL in attacker payloads indicates it is used to deliver or facilitate malicious tools or callbacks. If accessed, it could enable attackers to transfer tools into a victim environment, potentially aiding further compromise. However, no specific exploit or active in-the-wild exploitation beyond the observed URL usage is reported. The impact is primarily as a vector for ingress tool transfer, which could lead to further malicious activity if not blocked.

Defensive guidance

Block and monitor the identified URL (https://cdn.876553.xyz/Q1fc8a9OCb7AsC6f/dl/01b981d8-71fe-4578-b5d4-ed2b47f4eba5) in network security controls such as proxies, web gateways, and WAFs. Search existing logs for any requests to this URL to detect potential compromise.

Summary

The OffSeq Mirage threat intelligence platform observed a malicious URL used by attackers to transfer tools or payloads, identified by the technique T1105 (Ingress Tool Transfer). The URL was seen twice on a single day from attacker infrastructure in Hong Kong. This URL is part of attacker payload activity, potentially used for downloading tools or callbacks during an attack. The detection is based on honeypot sensor data and is intended as an indicator of compromise to aid defenders in identifying related malicious activity.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

URLs 1

Description

AI analysisMachine-generated, updated 9 Nov 2026, 04:19 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats