IndicatorPublished 07/24/2026
Attacker url observed in the wild: sbc.questblue.com (OffSeq Mirage)
Source OffSeq Mirage
Description
OffSeq Mirage honeypot sensors observed this attacker URL 2 time(s) in attacker activity between 2026-07-24 and 2026-07-24. Observed technique: T1071 (Application Layer Protocol). Seen from attacker infrastructure in FI. This URL was used as an out-of-band callback or command-and-control endpoint. Block and monitor it, and search your proxy/web/WAF logs for requests to it.
Indicators of compromise
URLs 1
- sbc.questblue.comOffSeq Mirage — an attacker callback / C2 URL, observed 2026-07-24..2026-07-24, 2×