Attacker url observed in the wild: interact.sh (OffSeq Mirage)

OffSeq Mirage honeypot sensors observed this attacker URL 12 time(s) in attacker activity between 2026-06-29 and 2026-06-29. Observed technique: T1071 (Application Layer Protocol). Seen from attacker infrastructure in FR. This URL was used as an out-of-band callback or command-and-control endpoint. Block and monitor it, and search your proxy/web/WAF logs for requests to it.

• mirage.offseq.com (opens in a new tab)

• Attacker url observed in the wild: http://vagos.cc/Sakura.sh (OffSeq Mirage)Indicator2026-11-11
• Attacker url observed in the wild: http://botnet.code.wf/Sakura.sh (OffSeq Mirage)Indicator2026-11-11
• Attacker url observed in the wild: https://sites.google.com/view/systemctls/anDUsn (OffSeq Mirage)Indicator2026-11-11
• Attacker url observed in the wild: http://chaomoinguoi.duckdns.org:8080/dlr.sh (OffSeq Mirage)Indicator2026-11-09
• Attacker url observed in the wild: https://github.com (OffSeq Mirage)Indicator2026-11-09