IndicatorPublished 09/24/2026

Attacker url observed in the wild: test.invalid (OffSeq Mirage)

Source OffSeq Mirage

Description

The OffSeq Mirage honeypot sensors detected an attacker URL 'test.invalid' used as an out-of-band callback or command-and-control (C2) endpoint. This URL was observed 9 times on 2026-09-24 and is associated with the ATT&CK technique T1071.004, which involves application layer protocol communication for C2. The attacker infrastructure was identified in Switzerland (CH). No specific software versions are affected, and no known exploits or threat actors are linked to this indicator.

Summary

OffSeq Mirage honeypot sensors observed the URL 'test.invalid' being used as a command-and-control or callback endpoint in attacker activity on 2026-09-24. The activity aligns with MITRE ATT&CK technique T1071.004, which involves using application layer protocols for C2 communication. The attacker infrastructure was located in Switzerland. This indicator serves as an out-of-band callback URL used by attackers, but no direct exploit or vulnerability is described. It is an indicator of compromise rather than a software vulnerability.

Impact

The presence of this URL indicates potential attacker command-and-control activity, which could facilitate remote control or data exfiltration if contacted by compromised systems. However, no direct exploit or vulnerability is described, and no known active exploitation is reported. The impact is limited to detection and blocking of communications to this URL to prevent attacker control.

Defensive guidance

Block and monitor network traffic to the URL 'test.invalid'. Search proxy, web, and WAF logs for any requests to this URL to identify potential compromise or attacker activity. Since this is an indicator of compromise rather than a vulnerability, no patch or software update is applicable.

Indicators of compromise

URLs 1

test.invalidOffSeq Mirage — an attacker callback / C2 URL, observed 2026-09-24..2026-09-24, 9×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:17:50 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats