Attacker url observed in the wild: https://pentest-tools.com/ (OffSeq Mirage)

The URL https://pentest-tools.com/ was observed twice in attacker activity on 2026-10-26 by OffSeq Mirage honeypot sensors. It was used in attacker payloads involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it may serve as a tool download, callback, or exploitation target. The attacker infrastructure was located in Germany. There is no evidence of active exploitation or known threat actors associated with this URL at this time.

• mirage.offseq.com (opens in a new tab)

• Attacker url observed in the wild: https://pastebin.com/raw/QGrjKCsR (OffSeq Mirage)Indicator2026-10-25
• Attacker url observed in the wild: http://play.nopixel-rp.ir/ (OffSeq Mirage)Indicator2026-10-24
• Attacker url observed in the wild: https://wrpddqm0rp.rbmock.dev/ (OffSeq Mirage)Indicator2026-10-24
• Attacker url observed in the wild: chinamobile.com (OffSeq Mirage)Indicator2026-07-20
• Attacker url observed in the wild: www.interact.sh (OffSeq Mirage)Indicator2026-06-29