IndicatorPublished 31 Oct 2026

Attacker url observed in the wild: https://dpaste.org/BXu7Y/raw (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2021-42013

Indicators of compromise

URLs 1

OffSeq Mirage — an attacker payload URL, observed 2026-10-31..2026-10-31, 6× (CVE-2021-42013)

https://dpaste.org/BXu7Y/raw

Description

A URL associated with attacker activity linked to CVE-2021-42013 was observed multiple times in the wild on 2026-10-31. This URL was used in attacker payloads involving tool downloads or callbacks, indicating its role in ingress tool transfer (technique T1105). The attacker infrastructure was identified in India. Security teams are advised to block and monitor this URL and review proxy, web, and WAF logs for any access attempts.

Impact

The URL is linked to attacker payload delivery exploiting CVE-2021-42013, which is a known vulnerability. While the exact impact of this URL usage is not detailed, its presence in attacker payloads suggests it facilitates malicious tool transfer or exploitation attempts. No confirmed active exploitation or additional impact details are provided.

Defensive guidance

Block and monitor the URL https://dpaste.org/BXu7Y/raw in network defenses such as proxies, web gateways, and WAFs. Search existing logs for any requests to this URL to identify potential compromise or reconnaissance activity.

Summary

OffSeq Mirage honeypot sensors detected the URL https://dpaste.org/BXu7Y/raw six times on 2026-10-31 as part of attacker activity related to CVE-2021-42013. The URL was used in payloads for ingress tool transfer (MITRE ATT&CK technique T1105), serving as a tool download, callback, or exploitation target. The attacker infrastructure was traced to India. This indicator serves as a threat intelligence artifact to detect and block ongoing exploitation attempts associated with this vulnerability.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

URLs 1

Description

AI analysisMachine-generated, updated 31 Oct 2026, 17:08 UTC

MITRE ATT&CK techniques1 from threat tags

References

Community reviews

Related threats