IndicatorPublished 08/19/2026Updated 10/13/2026
Attacker url observed in the wild: log4shell_jndi (OffSeq Mirage)
Source OffSeq Mirage
Description
OffSeq Mirage honeypot sensors observed this attacker URL 1,954 time(s) in attacker activity between 2026-08-19 and 2026-10-13. Observed technique: T1190 (Exploit Public-Facing Application). Seen from attacker infrastructure in AT, BE, CH, DE, ES, GB, KN, KZ. This URL was injected as a JNDI lookup to trigger remote class loading (Log4Shell-style exploitation). Block and monitor it, and search your proxy/web/WAF logs for requests to it.
Indicators of compromise
URLs 1
- log4shell_jndiOffSeq Mirage — a JNDI/Log4Shell exploitation callback, observed 2026-08-19..2026-10-13, 1954×