IndicatorPublished 07/19/2026
Attacker url observed in the wild: https://sistemasyusa.icu/admin/productimages/unkillbot_x8… (OffSeq Mirage)
Source OffSeq Mirage
Description
OffSeq Mirage honeypot sensors observed this attacker URL 17 time(s) in attacker activity between 2026-07-19 and 2026-07-19. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in PH. This URL was observed in attacker payloads (tool download, callback, or exploitation target). Block and monitor it, and search your proxy/web/WAF logs for requests to it.
Indicators of compromise
URLs 1
- https://sistemasyusa.icu/admin/productimages/unkillbot_x86_64OffSeq Mirage — an attacker payload URL, observed 2026-07-19..2026-07-19, 17×