IndicatorPublished 09/20/2026Updated 10/03/2026

Attacker url observed in the wild: oast.me (OffSeq Mirage)

Source OffSeq Mirage

Description

The URL 'oast.me' has been observed in attacker activity as an out-of-band callback or command-and-control (C2) endpoint. This activity was detected by OffSeq Mirage honeypot sensors four times between September 20, 2026, and October 3, 2026. The observed technique corresponds to MITRE ATT&CK T1071, which involves using application layer protocols for command and control. The attacker infrastructure was identified as originating from Lithuania (LT). Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.

Summary

OffSeq Mirage honeypot sensors detected the URL 'oast.me' being used as an attacker callback or C2 endpoint in the wild, observed four times over a two-week period in late 2026. The activity aligns with MITRE ATT&CK technique T1071, indicating use of application layer protocols for command and control communications. The attacker infrastructure was traced to Lithuania. This URL serves as an indicator of compromise (IOC) rather than a vulnerability or exploit itself.

Impact

The presence of 'oast.me' as a callback or C2 URL indicates potential malicious command and control activity. If an organization’s network communicates with this URL, it may suggest compromise or ongoing attacker activity. However, no direct exploit or vulnerability is described, and no known exploits in the wild are reported for this indicator.

Defensive guidance

Organizations should block and monitor traffic to 'oast.me' at network perimeter controls such as firewalls, proxies, and web application firewalls (WAFs). They should also search their logs for any requests to this URL to detect possible compromise. No patch or fix is applicable as this is an attacker infrastructure indicator, not a software vulnerability.

Indicators of compromise

URLs 1

oast.meOffSeq Mirage — an attacker callback / C2 URL, observed 2026-09-20..2026-10-03, 4×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:17:53 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats