IndicatorPublished 08/24/2026Updated 09/24/2026

Attacker url observed in the wild: .log4j.check (OffSeq Mirage)

Source OffSeq Mirage

Description

The OffSeq Mirage honeypot sensors detected an attacker URL '.log4j.check' used as an out-of-band callback or command-and-control (C2) endpoint. This URL was observed 1,218 times between August 24, 2026, and September 24, 2026, originating from attacker infrastructure located in Nigeria, Ukraine, and the United States. The observed technique corresponds to T1071.004, which involves application layer protocol communication for C2. No direct exploit or vulnerability details are provided, and no affected software versions are identified.

Summary

OffSeq Mirage honeypot sensors recorded repeated attacker activity involving the URL '.log4j.check' used as a callback or C2 endpoint. The activity was observed over a one-month period with 1,218 occurrences. The attacker infrastructure was identified in NG, UA, and US. The technique used is T1071.004, indicating use of application layer protocols for command and control. This indicator serves as a detection and blocking target rather than describing a specific software vulnerability or exploit. There is no information about exploitation of a vulnerability or affected software versions.

Impact

The impact is limited to the presence of an attacker-controlled callback or C2 URL used in malicious activity. There is no direct evidence of exploitation of a vulnerability or compromise described. The URL represents an indicator of attacker infrastructure that may be used in broader attack campaigns. Organizations may be targeted by communications to this URL, potentially enabling attacker control or data exfiltration if not blocked.

Defensive guidance

Block and monitor network traffic to the '.log4j.check' URL. Search proxy, web, and WAF logs for any requests to this URL to detect potential attacker activity. There is no vendor patch or software fix associated with this indicator. Mitigation focuses on detection and network-level blocking of this known malicious URL.

Indicators of compromise

URLs 1

.log4j.checkOffSeq Mirage — an attacker callback / C2 URL, observed 2026-08-24..2026-09-24, 1218×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:31:06 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats