Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.
The URL www.interact.sh has been observed in the wild as an attacker-controlled callback or command-and-control (C2) endpoint. It was detected by OffSeq Mirage honeypot sensors five times between June 29, 2026, and October 22, 2026. The activity involved the use of the MITRE ATT&CK technique T1071 (Application Layer Protocol). The attacker infrastructure was identified in France, Turkey, and the United States. Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
OffSeq Mirage honeypot sensors detected the URL www.google.com being used as an attacker callback or command-and-control (C2) endpoint 220 times between August 24, 2026, and September 24, 2026. The observed technique corresponds to T1071.004, which involves application layer protocol communication for C2. The activity originated from attacker infrastructure located in Nigeria and the United States. This URL is flagged as an indicator of compromise (IOC) for monitoring and blocking in network defenses.
The URL webhook.site was observed in attacker activity as an out-of-band callback or command-and-control (C2) endpoint between 2026-10-01 and 2026-10-05. This activity was detected by OffSeq Mirage honeypot sensors and involved the use of the T1071 technique (Application Layer Protocol). The URL was seen originating from attacker infrastructure in Iran (IR) and Mali (ML).
The URL 'oast.me' has been observed in attacker activity as an out-of-band callback or command-and-control (C2) endpoint. This activity was detected by OffSeq Mirage honeypot sensors four times between September 20, 2026, and October 3, 2026. The observed technique corresponds to MITRE ATT&CK T1071, which involves using application layer protocols for command and control. The attacker infrastructure was identified as originating from Lithuania (LT). Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
A URL associated with attacker activity was observed multiple times between 2026-10-17 and 2026-10-19. This URL was used as an out-of-band callback or command-and-control (C2) endpoint, employing the T1071 technique (Application Layer Protocol). The attacker infrastructure was located in the Netherlands. Security teams are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
An attacker URL 'db7gmmcupag28tv6hn00opfunut1saqiz.oast.fun' was observed in the wild on 2026-10-14 by OffSeq Mirage honeypot sensors. The URL was used as an out-of-band callback or command-and-control (C2) endpoint associated with the ATT&CK technique T1071 (Application Layer Protocol). The attacker infrastructure was identified as originating from Turkey (TR). This URL was seen twice during the observation period. No specific software versions are affected as this is an indicator of compromise rather than a software vulnerability.
The URL da8ue2kupagblkmed22g71kjyejxromzd.oast.pro was observed in attacker activity as an out-of-band callback or command-and-control endpoint. This URL was detected twice on 2026-08-28 by OffSeq Mirage honeypot sensors. The observed technique corresponds to T1071 (Application Layer Protocol). The attacker infrastructure was located in Turkey (TR).
The OffSeq Mirage honeypot sensors detected an attacker-controlled URL used as a command-and-control (C2) or out-of-band callback endpoint. This URL was observed twice on 2026-08-28 and is associated with the T1071 technique (Application Layer Protocol). The attacker infrastructure was identified in Turkey (TR). Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
The URL da7h7gkupag53ubtlfng6iwxxod7xrzrk.oast.live was observed in the wild as an attacker callback or command-and-control (C2) endpoint. It was detected twice on August 26, 2026, by OffSeq Mirage honeypot sensors. The activity involved the use of the T1071 technique, which relates to application layer protocol communications. The attacker infrastructure was identified as originating from Turkey (TR).
The OffSeq Mirage honeypot sensors detected an attacker-controlled URL used as a command-and-control (C2) or out-of-band callback endpoint. This URL was observed twice on August 22, 2026, originating from attacker infrastructure in Turkey. The activity involved the use of the T1071 technique, which relates to application layer protocol communication. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
An attacker-controlled URL (da4ms7supagd531da040xszuj79z5wgss.oast.site) was observed in the wild on 2026-08-22 by OffSeq Mirage honeypot sensors. This URL was used as an out-of-band callback or command-and-control (C2) endpoint employing the T1071 technique (Application Layer Protocol). The activity was seen originating from attacker infrastructure in Turkey. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
The URL aws.oast.online was observed in attacker activity as a callback or command-and-control (C2) endpoint. It was detected by OffSeq Mirage honeypot sensors on 2026-10-21, with four occurrences noted. The activity involved the use of the T1071 technique, which relates to application layer protocol communications. The attacker infrastructure was identified as being located in Germany. This URL is associated with malicious out-of-band communications and should be blocked and monitored in network defenses.
The URL alibaba.oast.pro was observed in the wild as an attacker-controlled callback or command-and-control (C2) endpoint. It was detected twice on 2026-10-21 by OffSeq Mirage honeypot sensors using the T1071 technique (Application Layer Protocol). The attacker infrastructure was identified as located in Germany. This URL is associated with malicious activity and should be blocked and monitored in network defenses.
A malicious file identified by the SHA-256 hash fa4e294690bc1ffc2340daf400bd47fa58d515224f497f68fc2d280b1501f7cd was observed 55 times in attacker activity between July 15 and July 16, 2026. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure in multiple countries including Brazil, Hungary, Indonesia, India, Iran, Pakistan, Russia, and Turkey. The hash fingerprints a specific malicious payload which could be a dropper, web shell, miner, or post-exploitation tool. This indicator can be used to detect and block this malicious payload in affected environments.