IndicatorPublished 9 Nov 2026

Attacker url observed in the wild: https://github.com (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2021-41773

Indicators of compromise

URLs 1

OffSeq Mirage — an attacker payload URL, observed 2026-11-09..2026-11-09, 9× (CVE-2021-41773)

https://github.com

Description

OffSeq Mirage honeypot sensors observed the URL https://github.com being used in attacker activity associated with CVE-2021-41773 on 2026-11-09. The URL was seen 9 times as part of attacker payloads involving the T1105 technique (Ingress Tool Transfer), indicating it was used for tool download, callback, or exploitation targeting. The attacker infrastructure was identified as located in the US. This URL should be blocked and monitored in proxy, web, and WAF logs to detect related malicious activity.

Impact

The URL https://github.com was used in attacker payloads related to CVE-2021-41773, which is a vulnerability that could allow unauthorized access or code execution depending on the context of the vulnerable system. The presence of this URL in attacker activity suggests it may be used to download tools or payloads to facilitate exploitation. However, no direct evidence of active exploitation or impact beyond reconnaissance and tool transfer is provided.

Defensive guidance

Block and monitor the URL https://github.com in proxy, web, and WAF logs to detect and prevent attacker payload delivery related to CVE-2021-41773. Investigate any requests to this URL for potential malicious activity. Since this is an indicator of compromise rather than a vulnerability with a patch, focus on detection and blocking of this URL in your environment.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

URLs 1

Description

AI analysisMachine-generated, updated 9 Nov 2026, 18:35 UTC

MITRE ATT&CK techniques1 from threat tags

References

Community reviews

Related threats