OffSeq Mirage honeypot sensors observed the URL https://github.com being used in attacker activity associated with CVE-2021-41773 on 2026-11-09. The URL was seen 9 times as part of attacker payloads involving the T1105 technique (Ingress Tool Transfer), indicating it was used for tool download, callback, or exploitation targeting. The attacker infrastructure was identified as located in the US. This URL should be blocked and monitored in proxy, web, and WAF logs to detect related malicious activity.
The URL https://api.ipify.org has been observed in attacker activity linked to CVE-2021-41773. This URL was seen six times on 2026-11-09 as part of attacker payloads involving ingress tool transfer (T1105) techniques. The activity originated from attacker infrastructure in Great Britain. The URL is associated with exploitation attempts or tool downloads related to the referenced CVE.
OffSeq Mirage honeypot sensors detected an attacker URL used in the wild on 2026-11-09. The URL was observed twice and is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The attacker infrastructure was identified as being located in Hong Kong. This URL is linked to attacker payloads such as tool downloads, callbacks, or exploitation targets. Organizations are advised to block and monitor this URL and search their proxy, web, or WAF logs for any requests to it.
An attacker URL associated with CVE-2017-9841 was observed in the wild by OffSeq Mirage honeypot sensors on 2026-11-08. The URL was seen twice in attacker activity and is linked to the T1105 technique (Ingress Tool Transfer), indicating its use for downloading tools or payloads during attacks. The URL originated from attacker infrastructure located in the United Arab Emirates (AE).
The URL http://phubotnet.duckdns.org/main_sh4 was observed in attacker activity between 2026-11-05 and 2026-11-06 by OffSeq Mirage honeypot sensors. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in South Korea. The URL has been used in attacker payloads such as tool downloads, callbacks, or exploitation targets. Defenders are advised to block and monitor this URL and search proxy, web, and WAF logs for any requests to it.
The URL http://phubotnet.duckdns.org/main_x86 was observed in attacker activity by OffSeq Mirage honeypot sensors on two occasions between 2026-11-05 and 2026-11-06. This URL is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen as part of attacker payloads, such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified as originating from South Korea (KR). Organizations are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
OffSeq Mirage honeypot sensors detected an attacker URL (http://phubotnet.duckdns.org/main_mips) twice between November 5 and 6, 2026. The URL is associated with the ATT&CK technique T1105 (Ingress Tool Transfer) and was observed originating from attacker infrastructure in South Korea. This URL was used in attacker payloads, including tool downloads, callbacks, or exploitation targets. Organizations are advised to block and monitor this URL and review proxy, web, and WAF logs for any requests to it.
A URL hosting an attacker payload related to CVE-2017-9841 was observed in the wild by OffSeq Mirage honeypot sensors on 2026-11-05. The URL was seen three times and is associated with the T1105 technique (Ingress Tool Transfer). The attacker infrastructure was identified in the United Arab Emirates (AE). This URL is used for tool download, callback, or exploitation targeting. Defenders are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
OffSeq Mirage honeypot sensors detected an attacker URL linked to CVE-2021-41773, observed 24 times on 2026-11-04. The URL points to a payload hosted on GitHub for xmrig version 6.22.2, associated with the T1105 technique (Ingress Tool Transfer). The attacker infrastructure was identified in the US. This URL was used in attacker payloads for tool download or exploitation. Defenders are advised to block and monitor this URL and search logs for related requests.
The URL 'oast.pro' has been observed in attacker activity involving ingress tool transfer (T1105) on 2026-11-02. This URL was seen in attacker payloads used for tool download, callback, or exploitation targeting. The activity originated from attacker infrastructure located in France. Security teams are advised to block and monitor this URL and search their proxy, web, or WAF logs for any requests to it.
A URL associated with attacker activity was observed in the wild by OffSeq Mirage honeypot sensors on 2026-11-01. The URL, dbj8e4hhhsec5qnnue906fprppz3d315h.oast.live, was used as an out-of-band callback or command-and-control (C2) endpoint employing the T1071 technique (Application Layer Protocol). The attacker infrastructure was identified in Brazil. Security teams are advised to block and monitor this URL and search their proxy, web, and WAF logs for any requests to it.
An attacker URL linked to CVE-2021-42013 was observed in the wild by OffSeq Mirage honeypot sensors on 2026-10-31. The URL was seen five times in attacker activity originating from infrastructure in India. The activity involved the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating the URL was used for payload delivery or exploitation. Organizations are advised to block and monitor this URL and search their proxy, web, or WAF logs for any requests to it.
A URL associated with attacker activity linked to CVE-2021-42013 was observed multiple times in the wild on 2026-10-31. This URL was used in attacker payloads involving tool downloads or callbacks, indicating its role in ingress tool transfer (technique T1105). The attacker infrastructure was identified in India. Security teams are advised to block and monitor this URL and review proxy, web, and WAF logs for any access attempts.
The URL https://pentest-tools.com/ was observed twice in attacker activity on 2026-10-26 by OffSeq Mirage honeypot sensors. It was used in attacker payloads involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it may serve as a tool download, callback, or exploitation target. The attacker infrastructure was located in Germany. There is no evidence of active exploitation or known threat actors associated with this URL at this time.
The URL https://pastebin.com/raw/QGrjKCsR was observed in the wild as part of attacker activity on 2026-10-25. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating it was used for tool download, callback, or exploitation purposes. The activity was detected by OffSeq Mirage honeypot sensors and originated from attacker infrastructure in Great Britain. There are no known exploits actively using this URL, and no specific affected software versions have been identified.
The URL http://play.nopixel-rp.ir/ was observed twice in attacker activity on 2026-10-24 by OffSeq Mirage honeypot sensors. It is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer), indicating its use in attacker payloads such as tool downloads, callbacks, or exploitation targets. The attacker infrastructure was identified as originating from Great Britain. This URL serves as an indicator of compromise (IOC) and should be blocked and monitored in network defenses.
An attacker URL https://wrpddqm0rp.rbmock.dev/ was observed in the wild by OffSeq Mirage honeypot sensors on 2026-10-24. The URL was seen 4 times in attacker activity related to the T1105 technique (Ingress Tool Transfer), indicating its use for payload delivery or command and control. The attacker infrastructure was located in Colorado, USA. This URL is associated with attacker payloads such as tool downloads, callbacks, or exploitation targets. No specific software versions are affected, and no known exploits are reported in the wild for this indicator.
An attacker URL (http://en2an.top/cleanfda/init.sh) was observed in the wild by OffSeq Mirage honeypot sensors on 2026-10-23. The URL is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen twice in attacker activity originating from infrastructure in China. This URL is linked to attacker payloads such as tool downloads, callbacks, or exploitation targets. No specific software versions or CVEs are associated with this indicator. No known exploits or threat actors have been confirmed in connection with this URL.
The URL alibaba.oast.pro was observed in the wild as an attacker-controlled callback or command-and-control (C2) endpoint. It was detected twice on 2026-10-21 by OffSeq Mirage honeypot sensors using the T1071 technique (Application Layer Protocol). The attacker infrastructure was identified as located in Germany. This URL is associated with malicious activity and should be blocked and monitored in network defenses.
The URL aws.oast.online was observed in attacker activity as a callback or command-and-control (C2) endpoint. It was detected by OffSeq Mirage honeypot sensors on 2026-10-21, with four occurrences noted. The activity involved the use of the T1071 technique, which relates to application layer protocol communications. The attacker infrastructure was identified as being located in Germany. This URL is associated with malicious out-of-band communications and should be blocked and monitored in network defenses.