A URL associated with attacker activity was observed multiple times between 2026-10-17 and 2026-10-19. This URL was used as an out-of-band callback or command-and-control (C2) endpoint, employing the T1071 technique (Application Layer Protocol). The attacker infrastructure was located in the Netherlands. Security teams are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
An attacker URL 'db7gmmcupag28tv6hn00opfunut1saqiz.oast.fun' was observed in the wild on 2026-10-14 by OffSeq Mirage honeypot sensors. The URL was used as an out-of-band callback or command-and-control (C2) endpoint associated with the ATT&CK technique T1071 (Application Layer Protocol). The attacker infrastructure was identified as originating from Turkey (TR). This URL was seen twice during the observation period. No specific software versions are affected as this is an indicator of compromise rather than a software vulnerability.
The URL webhook.site was observed in attacker activity as an out-of-band callback or command-and-control (C2) endpoint between 2026-10-01 and 2026-10-05. This activity was detected by OffSeq Mirage honeypot sensors and involved the use of the T1071 technique (Application Layer Protocol). The URL was seen originating from attacker infrastructure in Iran (IR) and Mali (ML).
The URL 'oast.me' has been observed in attacker activity as an out-of-band callback or command-and-control (C2) endpoint. This activity was detected by OffSeq Mirage honeypot sensors four times between September 20, 2026, and October 3, 2026. The observed technique corresponds to MITRE ATT&CK T1071, which involves using application layer protocols for command and control. The attacker infrastructure was identified as originating from Lithuania (LT). Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
The URL da8ue2kupagblkmed22g71kjyejxromzd.oast.pro was observed in attacker activity as an out-of-band callback or command-and-control endpoint. This URL was detected twice on 2026-08-28 by OffSeq Mirage honeypot sensors. The observed technique corresponds to T1071 (Application Layer Protocol). The attacker infrastructure was located in Turkey (TR).
The OffSeq Mirage honeypot sensors detected an attacker-controlled URL used as a command-and-control (C2) or out-of-band callback endpoint. This URL was observed twice on 2026-08-28 and is associated with the T1071 technique (Application Layer Protocol). The attacker infrastructure was identified in Turkey (TR). Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
The URL da7h7gkupag53ubtlfng6iwxxod7xrzrk.oast.live was observed in the wild as an attacker callback or command-and-control (C2) endpoint. It was detected twice on August 26, 2026, by OffSeq Mirage honeypot sensors. The activity involved the use of the T1071 technique, which relates to application layer protocol communications. The attacker infrastructure was identified as originating from Turkey (TR).
OffSeq Mirage honeypot sensors detected the URL www.google.com being used as an attacker callback or command-and-control (C2) endpoint 220 times between August 24, 2026, and September 24, 2026. The observed technique corresponds to T1071.004, which involves application layer protocol communication for C2. The activity originated from attacker infrastructure located in Nigeria and the United States. This URL is flagged as an indicator of compromise (IOC) for monitoring and blocking in network defenses.
The OffSeq Mirage honeypot sensors detected an attacker-controlled URL used as a command-and-control (C2) or out-of-band callback endpoint. This URL was observed twice on August 22, 2026, originating from attacker infrastructure in Turkey. The activity involved the use of the T1071 technique, which relates to application layer protocol communication. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
An attacker-controlled URL (da4ms7supagd531da040xszuj79z5wgss.oast.site) was observed in the wild on 2026-08-22 by OffSeq Mirage honeypot sensors. This URL was used as an out-of-band callback or command-and-control (C2) endpoint employing the T1071 technique (Application Layer Protocol). The activity was seen originating from attacker infrastructure in Turkey. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
The URL http://vps.atlas101.us.kg:7768/dl.sh was observed in attacker activity by OffSeq Mirage honeypot sensors on August 17, 2026. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it is used for transferring tools or payloads during attacks. The attacker infrastructure was identified as originating from Bulgaria. This URL has been seen in attacker payloads such as tool downloads, callbacks, or exploitation targets. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
The URL sbc.questblue.com was observed in the wild as an attacker callback or command-and-control (C2) endpoint. This activity was detected by OffSeq Mirage honeypot sensors on July 24, 2026, with two occurrences noted. The technique involved is T1071, which relates to the use of application layer protocols for command and control. The attacker infrastructure was identified as originating from Finland (FI).
The URL https://psychologylifecentre.com/bins/unkillbot_x86_64 was observed in attacker activity on 2026-07-20 by OffSeq Mirage honeypot sensors. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it is used for transferring attacker tools or payloads. The URL was seen four times and linked to attacker infrastructure located in the United States. It is recommended to block and monitor this URL and search proxy, web, and WAF logs for any requests to it.
The URL chinamobile.com was observed as an attacker callback or command-and-control (C2) endpoint in the wild between 2026-07-20 and 2026-08-11. This activity was detected by OffSeq Mirage honeypot sensors 32 times and involved the use of the T1071 technique (Application Layer Protocol). The attacker infrastructure was identified in France. Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
An attacker URL https://psychologylifecentre.com/bins/$b was observed in the wild by OffSeq Mirage honeypot sensors 38 times between July 19 and July 21, 2026. The URL is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen in attacker payloads such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified in the Philippines and the United States. Defenders are advised to block and monitor this URL and search their proxy, web, or WAF logs for any requests to it.
A URL associated with attacker activity was observed multiple times in the wild on July 19, 2026. The URL, hosted on sistemasyusa.icu, was linked to an attacker payload involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). This URL was seen in attacker payloads such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified as originating from the Philippines. Defenders are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
A URL associated with attacker activity was observed multiple times on July 18, 2026. The URL, https://sistemasyusa.icu/admin/productimages/b, was detected by OffSeq Mirage honeypot sensors and linked to the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The attacker infrastructure was identified as originating from the Philippines. This URL has been used in attacker payloads such as tool downloads, callbacks, or exploitation targets. No specific software vulnerability or exploit code is detailed.
A URL hosting an attacker payload script (http://bins.oceanic-node.su/wget.sh) was observed multiple times in attacker activity between July and August 2026. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the URL was used for tool download or callback. The attacker infrastructure was identified in Hong Kong, South Korea, and Taiwan. This URL is considered an indicator of compromise and should be blocked and monitored in network defenses.
OffSeq Mirage honeypot sensors observed this attacker URL 9 time(s) in attacker activity between 2026-07-09 and 2026-07-09. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in TH, TZ. This URL was observed in attacker payloads (tool download, callback, or exploitation target). Block and monitor it, and search your proxy/web/WAF logs for requests to it.
The URL www.interact.sh has been observed in the wild as an attacker-controlled callback or command-and-control (C2) endpoint. It was detected by OffSeq Mirage honeypot sensors five times between June 29, 2026, and October 22, 2026. The activity involved the use of the MITRE ATT&CK technique T1071 (Application Layer Protocol). The attacker infrastructure was identified in France, Turkey, and the United States. Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.