The URL http://phubotnet.duckdns.org/main_sh4 was observed in attacker activity between 2026-11-05 and 2026-11-06 by OffSeq Mirage honeypot sensors. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in South Korea. The URL has been used in attacker payloads such as tool downloads, callbacks, or exploitation targets. Defenders are advised to block and monitor this URL and search proxy, web, and WAF logs for any requests to it.
The URL http://phubotnet.duckdns.org/main_x86 was observed in attacker activity by OffSeq Mirage honeypot sensors on two occasions between 2026-11-05 and 2026-11-06. This URL is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen as part of attacker payloads, such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified as originating from South Korea (KR). Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
OffSeq Mirage honeypot sensors detected an attacker URL (http://phubotnet.duckdns.org/main_mips) twice between November 5 and 6, 2026. The URL is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was observed originating from attacker infrastructure in South Korea. This URL was used in attacker payloads, including tool downloads, callbacks, or exploitation targets. Organizations are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
A URL hosting an attacker payload related to CVE-2017-9841 was observed in the wild by OffSeq Mirage honeypot sensors on 2026-11-05. The URL was seen three times and is associated with the T1105 technique (Ingress Tool Transfer). The attacker infrastructure was identified in the United Arab Emirates (AE). This URL is used for tool download, callback, or exploitation targeting. Defenders are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
OffSeq Mirage honeypot sensors detected an attacker URL linked to CVE-2021-41773, observed 24 times on 2026-11-04. The URL points to a payload hosted on GitHub for xmrig version 6.22.2, associated with the T1105 technique (Ingress Tool Transfer). The attacker infrastructure was identified in the US. This URL was used in attacker payloads for tool download or exploitation. Defenders are advised to block and monitor this URL and search logs for related requests.
A malicious file identified by the SHA-256 hash 73850adc8e9319594baa05b5419dec3a1ccb32fe40beb55fe5647b017ef73df2 was observed by OffSeq Mirage honeypot sensors on 2026-11-02. This file is associated with CVE-2026-109618 and linked to the ATT&CK technique T1105 (Ingress Tool Transfer). The file represents a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool used during attacker activity. The threat was observed originating from attacker infrastructure in Lithuania (LT).
A malicious file identified by the SHA-256 hash 9ed487498235f289a960a5cc794fa0ad0f9ef5c074860fea650e88c525da0ab4 was observed by OffSeq Mirage honeypot sensors on November 2, 2026. This file was detected twice in attacker activity originating from infrastructure in France. The observed attack technique is T1105 (Ingress Tool Transfer), indicating the file is likely a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash 2ddf902d0e9c4d8f28598df149c4ad3fee4d966b5c2b1e8eff5cb2677ddb3130 was observed twice in attacker activity on November 2, 2026. The attack involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the file was used to transfer tools into a target environment. The file is associated with a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in France. This indicator should be matched against files in environments and security feeds to detect potential compromise.
The URL 'oast.pro' has been observed in attacker activity involving ingress tool transfer (T1105) on 2026-11-02. This URL was seen in attacker payloads used for tool download, callback, or exploitation targeting. The activity originated from attacker infrastructure located in France. Security teams are advised to block and monitor this URL and search their proxy, web, or WAF logs for any requests to it.
A malicious file identified by the SHA-256 hash 5cb46c2be1604c22a410de06f851cf0e2e80c7eef3583f92a1080fbab1c224dc was observed by OffSeq Mirage honeypot sensors on 2026-11-02. The file was seen 12 times in attacker activity involving the T1105 technique (Ingress Tool Transfer) originating from attacker infrastructure in France. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this hash to detect potential compromise.
A malicious file identified by the SHA-256 hash 5349666da6dc9f096b7192658b07d80ddf5a77fecd8f8075f1595c23038a7adb was observed by OffSeq Mirage honeypot sensors on 2026-11-02. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer), indicating it was used to stage or deliver a malicious payload such as a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in France. This indicator can be used to detect the presence of this malicious payload in environments by matching the hash against files in endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds.
A malicious file identified by the SHA-256 hash a6238b62f373d3ddbad8a034aa94debb0f4b6b9642da6f3120a99565e97ece1d was observed twice in attacker activity on 2026-11-02. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in France. This hash fingerprints a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool used during the attack. Organizations are advised to check their environments and security tools for this hash to detect potential compromise.
A malicious file identified by the SHA-256 hash ba1f9d2e31f7d4aa9b56d39c6e2d5090fff1645b31b8a26dc5e50da22aa244bf was observed twice on November 2, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The payload could be a dropper, web shell, miner, or post-exploitation tool delivered or staged during the attack. The attacker infrastructure was located in France. This indicator can be used to detect the presence of this malicious file in environments through matching with endpoint detection and response (EDR), antivirus (AV), or threat intelligence feeds.
A malicious file identified by the SHA-256 hash 2807c004092b2c84f1d3e9cefc5277d54a42fadce97788e02e8098fd7ff8ba86 was observed by OffSeq Mirage honeypot sensors during attacker activity on 2026-11-02. The file is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in France. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool that was staged or delivered during the attack. Organizations are advised to match this hash against files in their environments and threat intelligence feeds.
A malicious file identified by the SHA-256 hash 1aa17abe3be18c408e72a38290f3ffb8a6d96bf4862fed9d9e4209822f5039f5 was observed by OffSeq Mirage honeypot sensors on 2026-11-02. The file was involved in attacker activity using technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in France. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security feeds to detect potential compromise.
A malicious file identified by the SHA-256 hash b6833206a0c545d501275e8fd91955befd900adfdf1a4bfb0c0759bf3606e9bb was observed by OffSeq Mirage honeypot sensors on 2026-11-02. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in France. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check their environments and security tools for this file hash to detect potential compromise.
A malicious file identified by the SHA-256 hash 58c8e25de53f0b4c9afee286556cc8d70d7a7f4900689ab09454640af01aa7cd was observed twice on November 2, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and was seen originating from infrastructure in France. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash d8e47c699b68eac208cb265deb82902f613cee0391549f14f94f1c3305b6fb93 was observed twice on November 2, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in France. This hash can be used to detect the presence of this malicious file in environments and security tools.
A malicious file identified by the SHA-256 hash a8a4c7376a27c9b5ad8cdc6a0fd970b77e28843b2a0349f4e1b49ad5bdcdf6d7 was observed by OffSeq Mirage honeypot sensors during attacker activity between November 2 and November 4, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and is linked to attacker infrastructure located in Romania. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. The file was seen twice in the wild during this period. There is no information about active exploitation or known threat actors. No affected software versions are specified.
A URL associated with attacker activity was observed in the wild by OffSeq Mirage honeypot sensors on 2026-11-01. The URL, dbj8e4hhhsec5qnnue906fprppz3d315h.oast.live, was used as an out-of-band callback or command-and-control (C2) endpoint employing the T1071 technique (Application Layer Protocol). The attacker infrastructure was identified in Brazil. Security teams are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.