IndicatorPublished 06/29/2026Updated 10/22/2026

Attacker url observed in the wild: www.interact.sh (OffSeq Mirage)

Source OffSeq Mirage

Description

The URL www.interact.sh has been observed in the wild as an attacker-controlled callback or command-and-control (C2) endpoint. It was detected by OffSeq Mirage honeypot sensors five times between June 29, 2026, and October 22, 2026. The activity involved the use of the MITRE ATT&CK technique T1071 (Application Layer Protocol). The attacker infrastructure was identified in France, Turkey, and the United States. Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.

Summary

OffSeq Mirage honeypot sensors detected the URL www.interact.sh being used as an out-of-band callback or command-and-control endpoint in attacker activity. This URL was observed five times over several months in 2026, associated with the ATT&CK technique T1071, which involves application layer protocol communications. The attacker infrastructure was located in multiple countries (FR, TR, US). This URL serves as an indicator of compromise (IOC) for potential malicious network traffic related to command-and-control operations.

Impact

The presence of this URL in network traffic indicates potential malicious command-and-control communication, which could facilitate attacker control over compromised systems. While no direct exploit or malware is described, detection of this URL suggests active attacker infrastructure and possible ongoing intrusion attempts or data exfiltration via application layer protocols.

Defensive guidance

Block and monitor the URL www.interact.sh at network perimeter controls such as firewalls, proxies, and web application firewalls (WAFs). Search existing proxy, web, and WAF logs for any requests to this URL to identify potential compromise. No patch or software fix is applicable as this is an external attacker infrastructure indicator. Continued monitoring and blocking of this URL is recommended to prevent attacker callbacks.

Indicators of compromise

URLs 1

www.interact.shOffSeq Mirage — an attacker callback / C2 URL, observed 2026-06-29..2026-10-22, 5×

References

mirage.offseq.com (opens in a new tab)

Description

AnalysisAI-generated, updated 10/24/2026, 08:17:41 UTC

Technical details

Indicators of compromise

URLs 1

References

Related threats