CYBERRAKSHAK LABS ยท DAILY GLOBAL THREAT INTELLIGENCE
GTI Feed โ 19 September 2026
100 indicators selected from the supplied feed. IOCs are defanged for safe publication. Confidence reflects the source-provided value.
Table format: IoC ยท Severity ยท Confidence ยท Involved Threat Type ยท Malware / Family ยท Brief Attack Description
| IoC | Severity | Confidence | Involved Threat Type | Malware / Family | Brief Attack Description |
|---|---|---|---|---|---|
zzxryguzfq02042676[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
zouwemmig[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Feed-classified botnet / c2 associated with Unknown Loader. Source tag: abuse_ch. |
zecoorigelabs[.]shop | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
youareafagifyoufoundthis[.]com | Critical | 100/100 | Botnet / C2 | CeCbot | Feed-classified botnet / c2 associated with CeCbot. Source tag: abuse_ch. |
yoda-duct[.]xyz | Critical | 100/100 | Botnet / C2 | Snappy Client | Feed-classified botnet / c2 associated with Snappy Client. Source tag: abuse_ch. |
ykize140825p[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
y87fvt1g020426i[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
xxnoyhngfg[.]cn | Critical | 100/100 | Botnet / C2 | ValleyRAT | Feed-classified botnet / c2 associated with ValleyRAT. Source tag: abuse_ch. |
wwwvbcsajmj[.]cn | Critical | 100/100 | Botnet / C2 | ValleyRAT | Feed-classified botnet / c2 associated with ValleyRAT. Source tag: abuse_ch. |
wqhuc2gq08020426mws[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
windows-update-local[.]rest | Critical | 100/100 | Botnet / C2 | Stealc | Feed-classified botnet / c2 associated with Stealc. Source tag: abuse_ch. |
willowbox[.]xyz | Critical | 100/100 | Botnet / C2 | Unknown Loader | Feed-classified botnet / c2 associated with Unknown Loader. Source tag: abuse_ch. |
waylace[.]xyz | Critical | 100/100 | Botnet / C2 | Unknown Loader | Feed-classified botnet / c2 associated with Unknown Loader. Source tag: abuse_ch. |
war[.]cantdown[.]su | Critical | 100/100 | Botnet / C2 | Unknown Rat | Feed-classified botnet / c2 associated with Unknown Rat. Source tag: abuse_ch. |
walmagua[.]cc | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
vss7s6zte020426g12[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
vd1qf14082587[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
v6a5iq6qxq140825s[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
v4wbnux67t0204260[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
v0cow1k020426uj[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
utuhv[.]cn | Critical | 100/100 | Botnet / C2 | ValleyRAT | Feed-classified botnet / c2 associated with ValleyRAT. Source tag: abuse_ch. |
ureyd250425ft[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
um8e86140825vjg[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
u9cux020426d[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
u550[.]cantdown[.]su | Critical | 100/100 | Botnet / C2 | Unknown Rat | Feed-classified botnet / c2 associated with Unknown Rat. Source tag: abuse_ch. |
u47ijv6z070725o7q[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
twigoamwu[.]cfd | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
tulipstone[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Feed-classified botnet / c2 associated with ACR Stealer. Source tag: abuse_ch. |
truspanel[.]com | Critical | 100/100 | Botnet / C2 | Unknown Rat | Feed-classified botnet / c2 associated with Unknown Rat. Source tag: abuse_ch. |
tootiswe[.]cfd | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
tndr-panel[.]online | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
ticketreceipt[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Feed-classified botnet / c2 associated with Unknown Loader. Source tag: abuse_ch. |
terrystoner4[.]ddns[.]net | Critical | 100/100 | Botnet / C2 | Ave Maria | Feed-classified botnet / c2 associated with Ave Maria. Source tag: abuse_ch. |
sync[.]canyonmere[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Feed-classified botnet / c2 associated with ACR Stealer. Source tag: abuse_ch. |
swi[.]cantdown[.]su | Critical | 100/100 | Botnet / C2 | Unknown Rat | Feed-classified botnet / c2 associated with Unknown Rat. Source tag: abuse_ch. |
svhost-update-service[.]casa | Critical | 100/100 | Botnet / C2 | Stealc | Feed-classified botnet / c2 associated with Stealc. Source tag: abuse_ch. |
sunshinedreamuk[.]com | Critical | 100/100 | Botnet / C2 | Snappy Client | Feed-classified botnet / c2 associated with Snappy Client. Source tag: abuse_ch. |
stonestation[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Feed-classified botnet / c2 associated with Unknown Loader. Source tag: abuse_ch. |
spotalarm[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Feed-classified botnet / c2 associated with Unknown Loader. Source tag: abuse_ch. |
spamhaushackers[.]at | Critical | 100/100 | Botnet / C2 | CeCbot | Feed-classified botnet / c2 associated with CeCbot. Source tag: abuse_ch. |
sos[.]cantdown[.]su | Critical | 100/100 | Botnet / C2 | Unknown Rat | Feed-classified botnet / c2 associated with Unknown Rat. Source tag: abuse_ch. |
softcrate[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Feed-classified botnet / c2 associated with Unknown Loader. Source tag: abuse_ch. |
snippet[.]host | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
skullcode1[.]myddns[.]me | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
shieldprotect[.]duckdns[.]org | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
shdufysuf[.]com | Critical | 100/100 | Botnet / C2 | Ghost RAT | Feed-classified botnet / c2 associated with Ghost RAT. Source tag: abuse_ch. |
selkin[.]newddns[.]com | Critical | 100/100 | Botnet / C2 | STRRAT | Feed-classified botnet / c2 associated with STRRAT. Source tag: abuse_ch. |
sel[.]cantdown[.]su | Critical | 100/100 | Botnet / C2 | Unknown Rat | Feed-classified botnet / c2 associated with Unknown Rat. Source tag: abuse_ch. |
scrnmailpsie[.]com | Critical | 100/100 | Botnet / C2 | Pure RAT | Feed-classified botnet / c2 associated with Pure RAT. Source tag: abuse_ch. |
rp543g140825tby[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
rollcoil[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Feed-classified botnet / c2 associated with Unknown Loader. Source tag: abuse_ch. |
robinfireman[.]xyz | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
rmm[.]smartscreen[.]lifestyle | Critical | 100/100 | Botnet / C2 | Unknown Rat | Feed-classified botnet / c2 associated with Unknown Rat. Source tag: abuse_ch. |
riv4d3dsr17042596[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
report[.]pantrystudio18[.]lol | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
relay[.]serverkinetices[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Rat | Feed-classified botnet / c2 associated with Unknown Rat. Source tag: abuse_ch. |
relay[.]miranarts-top[.]cc | Critical | 100/100 | Botnet / C2 | Unknown Rat | Feed-classified botnet / c2 associated with Unknown Rat. Source tag: abuse_ch. |
ratatwista[.]com | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
ra3f9y140825h[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
queue[.]fastclimate[.]click | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
quantum-flex[.]cfd | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
qsttq0jyah020426pq[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
qdkopiqubr0204264l[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
q8mj4v5sc020426m01[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
pwcgc6140825i6b[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
pure8s[.]ddnsfree[.]com | Critical | 100/100 | Botnet / C2 | Pure RAT | Feed-classified botnet / c2 associated with Pure RAT. Source tag: abuse_ch. |
pullout[.]ezgateway[.]net | Critical | 100/100 | Botnet / C2 | Hype Agent | Feed-classified botnet / c2 associated with Hype Agent. Source tag: abuse_ch. |
prism-tech[.]cfd | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
prairielink[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Feed-classified botnet / c2 associated with Unknown Loader. Source tag: abuse_ch. |
planecorn[.]xyz | Critical | 100/100 | Botnet / C2 | Unknown Loader | Feed-classified botnet / c2 associated with Unknown Loader. Source tag: abuse_ch. |
pinkfriend[.]top | Critical | 100/100 | Botnet / C2 | Overlord | Feed-classified botnet / c2 associated with Overlord. Source tag: abuse_ch. |
pfdcocp140825d4[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
paperagreement[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Feed-classified botnet / c2 associated with Unknown Loader. Source tag: abuse_ch. |
paneagreement[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Feed-classified botnet / c2 associated with Unknown Loader. Source tag: abuse_ch. |
ov14c020426v[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
out-agent[.]duckdns[.]org | Critical | 100/100 | Botnet / C2 | Unknown Rat | Feed-classified botnet / c2 associated with Unknown Rat. Source tag: abuse_ch. |
orbittrack[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Feed-classified botnet / c2 associated with Unknown Loader. Source tag: abuse_ch. |
olrs9vga020426we5[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
o1n09oad7b170425rx[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
newpat4bk[.]duckdns[.]org | Critical | 100/100 | Botnet / C2 | Remcos | Feed-classified botnet / c2 associated with Remcos. Source tag: abuse_ch. |
newpat4[.]duckdns[.]org | Critical | 100/100 | Botnet / C2 | Remcos | Feed-classified botnet / c2 associated with Remcos. Source tag: abuse_ch. |
nef[.]cantdown[.]su | Critical | 100/100 | Botnet / C2 | Unknown Rat | Feed-classified botnet / c2 associated with Unknown Rat. Source tag: abuse_ch. |
ne2mfrw1604259fi[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
mypamella[.]xyz | Critical | 100/100 | Botnet / C2 | Overlay RAT | Feed-classified botnet / c2 associated with Overlay RAT. Source tag: abuse_ch. |
mt6y9isp140825c6c[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
mrr[.]cantdown[.]su | Critical | 100/100 | Botnet / C2 | Unknown Rat | Feed-classified botnet / c2 associated with Unknown Rat. Source tag: abuse_ch. |
moodess[.]ddns[.]net | Critical | 100/100 | Botnet / C2 | Unknown Rat | Feed-classified botnet / c2 associated with Unknown Rat. Source tag: abuse_ch. |
mon-blanc-01[.]cfd | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
metric[.]gardenpark[.]click | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
memaiagent[.]cfd | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
matie-bal[.]club | Critical | 100/100 | Botnet / C2 | ACR Stealer | Feed-classified botnet / c2 associated with ACR Stealer. Source tag: abuse_ch. |
mail[.]spark-trail95[.]xyz | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
lsakthu69u020426i1w[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
lovefromallareas[.]at | Critical | 100/100 | Botnet / C2 | CeCbot | Feed-classified botnet / c2 associated with CeCbot. Source tag: abuse_ch. |
logs[.]bestshoppingday[.]com | Critical | 100/100 | Botnet / C2 | PureLogs | Feed-classified botnet / c2 associated with PureLogs. Source tag: abuse_ch. |
login[.]nimbusforge[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Feed-classified botnet / c2 associated with ACR Stealer. Source tag: abuse_ch. |
lean[.]brilliancespontaneous[.]shop | Critical | 100/100 | Botnet / C2 | โ | Feed-classified botnet / c2 indicator. Source tag: abuse_ch. |
l4cbc1408255[.]cfd | Critical | 100/100 | Payload Delivery | ACR Stealer | Feed-classified payload delivery associated with ACR Stealer. Source tag: abuse_ch. |
kul[.]cantdown[.]su | Critical | 100/100 | Botnet / C2 | Unknown Rat | Feed-classified botnet / c2 associated with Unknown Rat. Source tag: abuse_ch. |
krem[.]mesoptik[.]com | Critical | 100/100 | Botnet / C2 | TelePuz | Feed-classified botnet / c2 associated with TelePuz. Source tag: abuse_ch. |
Source: User-provided IOC feed export. Original source timestamps and source classifications are retained in the GTI data layer for historical search and future detail pages.