IndicatorPublished 10/24/2026

Attacker url observed in the wild: https://wrpddqm0rp.rbmock.dev/ (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

offseq-mirage
ioc
in-the-wild
url
ATT&CK: 1 technique

Indicators of compromise

URLs 1

OffSeq Mirage — an attacker payload URL, observed 2026-10-24..2026-10-24, 4×

https://wrpddqm0rp.rbmock.dev/

Description

An attacker URL https://wrpddqm0rp.rbmock.dev/ was observed in the wild by OffSeq Mirage honeypot sensors on 2026-10-24. The URL was seen 4 times in attacker activity related to the T1105 technique (Ingress Tool Transfer), indicating its use for payload delivery or command and control. The attacker infrastructure was located in Colorado, USA. This URL is associated with attacker payloads such as tool downloads, callbacks, or exploitation targets. No specific software versions are affected, and no known exploits are reported in the wild for this indicator.

Impact

The presence of this URL in attacker payloads suggests it is used for delivering malicious tools or establishing callbacks, which could facilitate further compromise or persistence. However, no direct exploit or vulnerability is identified, and no known active exploitation is reported. The impact is primarily as a threat indicator to detect and block attacker infrastructure communications.

Defensive guidance

Block and monitor network traffic to and from https://wrpddqm0rp.rbmock.dev/. Search proxy, web, and WAF logs for any requests to this URL to identify potential compromise or attacker activity. No patch or fix is applicable as this is an attacker infrastructure indicator rather than a software vulnerability.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

URLs 1

Description

AI analysisMachine-generated, updated 10/24/2026, 14:57:20 UTC

Technical details

References

Community reviews

Related threats