Attacker url observed in the wild: https://sites.google.com/view/systemctls/anDUsn (OffSeq Mirage)

A URL associated with attacker activity was observed in the wild, linked to CVE-2021-41773 and CVE-2021-42013 vulnerabilities. The URL was seen 182 times on a single day and is related to the T1105 technique (Ingress Tool Transfer), indicating its use in attacker payload delivery or callbacks. The attacker infrastructure was identified in the US. This URL should be blocked and monitored in proxy, web, and WAF logs to detect potential exploitation attempts.

• mirage.offseq.com (opens in a new tab)

• CVE-2021-41773: Apache HTTP Server Path Traversal VulnerabilityHighVulnerability2021-11-03
• CVE-2021-42013: Apache HTTP Server Path Traversal VulnerabilityCriticalVulnerability2021-11-03
• Attacker url observed in the wild: http://chaomoinguoi.duckdns.org:8080/dlr.sh (OffSeq Mirage)Indicator2026-11-09
• Attacker url observed in the wild: https://github.com (OffSeq Mirage)Indicator2026-11-09
• Attacker url observed in the wild: https://api.ipify.org (OffSeq Mirage)Indicator2026-11-09