IndicatorPublished 5 Nov 2026

Attacker url observed in the wild: https://raw.githubusercontent.com/president32/uploader2/m… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2017-9841

Indicators of compromise

URLs 1

OffSeq Mirage — an attacker payload URL, observed 2026-11-05..2026-11-05, 3× (CVE-2017-9841)

https://raw.githubusercontent.com/president32/uploader2/main/emperor.php

Description

A URL hosting an attacker payload related to CVE-2017-9841 was observed in the wild by OffSeq Mirage honeypot sensors on 2026-11-05. The URL was seen three times and is associated with the T1105 technique (Ingress Tool Transfer). The attacker infrastructure was identified in the United Arab Emirates (AE). This URL is used for tool download, callback, or exploitation targeting. Defenders are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.

Impact

The presence of this URL in attacker payloads indicates active attempts to exploit CVE-2017-9841 by transferring malicious tools or payloads. While no direct exploitation or impact details are provided, the association with a known CVE suggests potential compromise if the payload is successfully delivered and executed.

Defensive guidance

Block and monitor the identified URL (https://raw.githubusercontent.com/president32/uploader2/main/emperor.php). Search proxy, web, and WAF logs for any requests to this URL to detect potential compromise attempts. There is no indication that the vulnerability CVE-2017-9841 is patched or mitigated by the vendor in this report; therefore, ensure that systems are updated according to vendor advisories for CVE-2017-9841. Apply standard controls to prevent ingress tool transfer and unauthorized payload execution.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

URLs 1

Description

AI analysisMachine-generated, updated 5 Nov 2026, 20:03 UTC

MITRE ATT&CK techniques1 from threat tags

References

Community reviews

Related threats