IndicatorPublished 10/25/2026

Attacker url observed in the wild: https://pastebin.com/raw/QGrjKCsR (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

URLs 1

OffSeq Mirage — an attacker payload URL, observed 2026-10-25..2026-10-25, 3×

https://pastebin.com/raw/QGrjKCsR

Description

The URL https://pastebin.com/raw/QGrjKCsR was observed in the wild as part of attacker activity on 2026-10-25. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used for tool download, callback, or exploitation purposes. The activity was detected by OffSeq Mirage honeypot sensors and originated from attacker infrastructure in Great Britain. There are no known exploits actively using this URL, and no specific affected software versions have been identified.

Impact

The presence of this URL in attacker payloads indicates potential malicious activity involving tool transfer or callbacks. While no direct exploit or vulnerability is confirmed, connections to this URL could signify compromise or ongoing attacker operations. Organizations that detect traffic to this URL may be experiencing or targeted by attacker activity.

Defensive guidance

Block and monitor access to the URL https://pastebin.com/raw/QGrjKCsR in proxy, web, and WAF logs. Search historical logs for any requests to this URL to identify potential compromise. There is no patch or fix applicable as this is an indicator URL rather than a software vulnerability. Implement network controls to prevent communication with this URL.

MITRE ATT&CK techniques

From threat tags

T1105Ingress Tool Transfer · Command and Control (opens in a new tab)

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

URLs 1

Description

AI analysisMachine-generated, updated 10/25/2026, 05:23:13 UTC

Technical details

MITRE ATT&CK techniques

References

Community reviews

Related threats