IndicatorPublished 31 Oct 2026

Attacker url observed in the wild: https://dpaste.org/qAr9p/raw (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2021-42013

Indicators of compromise

URLs 1

OffSeq Mirage — an attacker payload URL, observed 2026-10-31..2026-10-31, 5× (CVE-2021-42013)

https://dpaste.org/qAr9p/raw

Description

An attacker URL linked to CVE-2021-42013 was observed in the wild by OffSeq Mirage honeypot sensors on 2026-10-31. The URL was seen five times in attacker activity originating from infrastructure in India. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the URL was used for payload delivery or exploitation. Organizations are advised to block and monitor this URL and search their proxy, web, or WAF logs for any requests to it.

Impact

The URL is linked to CVE-2021-42013, a known vulnerability, and was actively used in attacker payloads. While no direct exploit code or confirmed exploitation in the wild is reported, the presence of this URL in attacker activity indicates an active attempt to leverage the vulnerability for ingress tool transfer. This could facilitate further exploitation or compromise if successful.

Defensive guidance

Block and monitor the URL https://dpaste.org/qAr9p/raw in network defenses such as proxies, web gateways, and WAFs. Search existing logs for any requests to this URL to identify potential compromise or attempted exploitation. There is no direct patch or fix related to this URL itself; mitigation relies on detection and blocking of this attacker infrastructure. Refer to vendor advisories for CVE-2021-42013 for patching the underlying vulnerability.

Summary

OffSeq Mirage honeypot sensors detected an attacker-controlled URL (https://dpaste.org/qAr9p/raw) associated with CVE-2021-42013, observed five times on 2026-10-31. The URL was used in attacker payloads involving the T1105 technique, which is related to ingress tool transfer, suggesting it was used to download tools or payloads during exploitation attempts. The attacker infrastructure was identified as located in India. This indicator is intended for detection and blocking to prevent exploitation related to CVE-2021-42013.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

URLs 1

Description

AI analysisMachine-generated, updated 31 Oct 2026, 17:37 UTC

MITRE ATT&CK techniques1 from threat tags

References

Community reviews

Related threats