IndicatorPublished 08/24/2026Updated 09/24/2026

Attacker url observed in the wild: www.google.com (OffSeq Mirage)

Source OffSeq Mirage

Description

OffSeq Mirage honeypot sensors detected the URL www.google.com being used as an attacker callback or command-and-control (C2) endpoint 220 times between August 24, 2026, and September 24, 2026. The observed technique corresponds to T1071.004, which involves application layer protocol communication for C2. The activity originated from attacker infrastructure located in Nigeria and the United States. This URL is flagged as an indicator of compromise (IOC) for monitoring and blocking in network defenses.

Summary

The OffSeq Mirage threat intelligence platform observed the URL www.google.com being used in attacker activity as an out-of-band callback or command-and-control endpoint. This was recorded 220 times over a one-month period in 2026. The technique identified is T1071.004, which refers to the use of application layer protocols for C2 communications. The source infrastructure for this activity was identified in Nigeria and the United States. Although the URL is a legitimate domain, it has been abused in this context as an attacker-controlled endpoint. There is no indication of a software vulnerability or exploit associated with this URL itself.

Impact

The impact is related to the use of the URL www.google.com as a command-and-control endpoint by attackers, which may facilitate remote control or data exfiltration in targeted environments. There is no direct vulnerability or exploit in the URL or associated software. The presence of this URL in network traffic may indicate compromise or malicious activity.

Defensive guidance

Block and monitor traffic to the URL www.google.com as identified by OffSeq Mirage. Search proxy, web, and WAF logs for any requests to this URL to detect potential attacker activity. Since this is an indicator of compromise rather than a software vulnerability, remediation involves network defense measures and monitoring. No patch or software fix applies.

Indicators of compromise

URLs 1

www.google.comOffSeq Mirage — an attacker callback / C2 URL, observed 2026-08-24..2026-09-24, 220×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:17:44 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats