IndicatorPublished 15 Nov 2026

Attacker url observed in the wild: https://cdn.876553.xyz/Q1fc8a9OCb7AsC6f/dl/7e86f0a7-1f6f-… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

URLs 1

OffSeq Mirage — an attacker payload URL, observed 2026-11-15..2026-11-15, 6×

https://cdn.876553.xyz/Q1fc8a9OCb7AsC6f/dl/7e86f0a7-1f6f-4568-ace9-5569b17bb75d?a=

Description

A URL associated with attacker activity was observed multiple times on 2026-11-15 by OffSeq Mirage honeypot sensors. The URL is linked to the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it may be used for downloading malicious tools or payloads. The attacker infrastructure was identified in Taiwan. Security teams are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.

Impact

The presence of this URL in attacker payloads suggests potential unauthorized tool transfer to victim systems, which could facilitate further compromise or lateral movement. However, no direct exploit or active attack impact is detailed. The threat is primarily an indicator of attacker infrastructure and activity rather than a vulnerability in software.

Defensive guidance

Block the identified URL at network perimeter controls such as proxies, web gateways, and WAFs. Monitor logs for any requests to this URL to detect possible compromise or attempted ingress tool transfer. Follow standard incident response procedures if the URL is observed in your environment.

Summary

OffSeq Mirage honeypot sensors detected an attacker-controlled URL used in payload delivery or callback activity consistent with the T1105 technique (Ingress Tool Transfer). This URL was observed six times on a single day from attacker infrastructure located in Taiwan. The URL is likely used to transfer tools or malicious payloads to compromised systems. No specific exploit or malware details are provided, and no known exploits in the wild are reported. The detection serves as an indicator of compromise (IOC) for network defense and monitoring.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

URLs 1

Description

AI analysisMachine-generated, updated 15 Nov 2026, 08:53 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats