IndicatorPublished 10/01/2026Updated 10/05/2026

Attacker url observed in the wild: webhook.site (OffSeq Mirage)

Source OffSeq Mirage

Description

The URL webhook.site was observed in attacker activity as an out-of-band callback or command-and-control (C2) endpoint between 2026-10-01 and 2026-10-05. This activity was detected by OffSeq Mirage honeypot sensors and involved the use of the T1071 technique (Application Layer Protocol). The URL was seen originating from attacker infrastructure in Iran (IR) and Mali (ML).

Summary

OffSeq Mirage honeypot sensors detected the URL webhook.site being used twice in attacker activity over a five-day period in early October 2026. The URL functioned as an out-of-band callback or command-and-control endpoint, leveraging the MITRE ATT&CK technique T1071, which involves communication over application layer protocols. The attacker infrastructure was identified in Iran and Mali. This indicator suggests that webhook.site was used for malicious callback or C2 communications during this timeframe.

Impact

The presence of webhook.site as a callback or C2 URL indicates potential attacker communication channels that could be used for command execution or data exfiltration. However, no specific exploit or active attack campaign is confirmed. The impact is primarily related to detection and blocking of this URL to prevent attacker communications.

Defensive guidance

Block and monitor the URL webhook.site in network defenses such as proxies, web gateways, and web application firewalls (WAFs). Search logs for any requests to this URL to identify potential attacker activity. No patch or software update is applicable as this is an indicator of compromise rather than a software vulnerability.

Indicators of compromise

URLs 1

webhook.siteOffSeq Mirage — an attacker callback / C2 URL, observed 2026-10-01..2026-10-05, 2×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:17:47 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats