IndicatorPublished 2 Nov 2026

Attacker url observed in the wild: oast.pro (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

URLs 1

OffSeq Mirage — an attacker payload URL, observed 2026-11-02..2026-11-02, 2×

oast.pro

Description

The URL 'oast.pro' has been observed in attacker activity involving ingress tool transfer (T1105) on 2026-11-02. This URL was seen in attacker payloads used for tool download, callback, or exploitation targeting. The activity originated from attacker infrastructure located in France. Security teams are advised to block and monitor this URL and search their proxy, web, or WAF logs for any requests to it.

Impact

The presence of 'oast.pro' in attacker payloads suggests it is used as a command and control or tool delivery endpoint. While no direct exploit or active threat actor association is confirmed, connections to this URL may indicate malicious activity such as unauthorized tool transfer. Organizations that detect traffic to this URL may be experiencing or targeted by intrusion attempts.

Defensive guidance

Organizations should block network traffic to 'oast.pro' and monitor proxy, web, and WAF logs for any requests to this URL. Investigate any such connections to identify potential compromise. Continuous monitoring and blocking of this URL is recommended.

Summary

OffSeq Mirage honeypot sensors detected the attacker-controlled URL 'oast.pro' twice on 2026-11-02. The URL was involved in attacker activity classified under MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating its use for transferring tools or payloads during attacks. The source of the activity was traced to infrastructure in France. This URL is considered an indicator of compromise (IOC) and has been observed in the wild but is not linked to any known exploit or threat actor at this time.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

URLs 1

Description

AI analysisMachine-generated, updated 2 Nov 2026, 17:44 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats