CYBERRAKSHAK LABS ยท DAILY GLOBAL THREAT INTELLIGENCE
GTI Feed โ 22 September 2026
100 indicators from the supplied daily feed, normalized for defensive publication with source confidence, threat type, malware/family and brief attack description.
Table format: IoC ยท Severity ยท Confidence ยท Involved Threat Type ยท Malware / Family ยท Brief Attack Description
| IoC | Severity | Confidence | Involved Threat Type | Malware / Family | Brief Attack Description |
|---|---|---|---|---|---|
hxxp://gaotlix[.]cn/getinstall64 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
43[.]224[.]224[.]72:7800 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
202[.]61[.]85[.]50:7800 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
202[.]61[.]85[.]50:7811 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
43[.]229[.]112[.]98:6667 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
192[.]253[.]228[.]137:7800 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
192[.]253[.]228[.]137:7811 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
154[.]82[.]92[.]12:7800 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
154[.]82[.]92[.]12:7811 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
41[.]41[.]128[.]115:5005 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.quasar rat activity; source classification: botnet_cc. |
hxxp://casasarticola[.]house/images/book/gate[.]php | Critical | 100/100 | Botnet / C2 | โ | Associated with win.pony activity; source classification: botnet_cc. |
wishcourt[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
121[.]43[.]58[.]113:81 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
hxxps://167[.]235[.]0[.]162/api/forensics | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
45[.]145[.]228[.]161:9999 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
47[.]116[.]130[.]234:82 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
116[.]62[.]174[.]16:81 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
130[.]94[.]66[.]86:80 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
fallport[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
116[.]118[.]0[.]222:443 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.nanocore activity; source classification: botnet_cc. |
47[.]122[.]120[.]188:81 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
101[.]34[.]208[.]175:8081 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
139[.]199[.]18[.]159:81 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
35[.]215[.]160[.]200:80 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
123[.]57[.]146[.]34:80 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
114[.]215[.]190[.]7:443 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
iwonderifulovemeaswell[.]vg | Critical | 100/100 | Botnet / C2 | โ | Associated with apk.cecbot activity; source classification: botnet_cc. |
lovefromallareas[.]at | Critical | 100/100 | Botnet / C2 | โ | Associated with apk.cecbot activity; source classification: botnet_cc. |
iloveuevenifudontlovemeback[.]is | Critical | 100/100 | Botnet / C2 | โ | Associated with apk.cecbot activity; source classification: botnet_cc. |
hxxps://103[.]101[.]85[.]26/gate | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
106[.]54[.]201[.]103:9999 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
81[.]70[.]21[.]163:80 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
112[.]126[.]27[.]96:80 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
45[.]207[.]219[.]134:8080 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
81[.]70[.]21[.]163:8000 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
47[.]99[.]109[.]10:8080 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
friendsanchor[.]xyz | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
doctorboundary[.]xyz | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
queue[.]fastclimate[.]click | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
tndr-panel[.]online | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
hxxps://tndr-panel[.]online/api[.]php | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
foldlodge[.]xyz | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
rmm[.]smartscreen[.]lifestyle | Critical | 100/100 | Botnet / C2 | Unknown RAT | Source classifies this indicator as unknown RAT activity. |
39[.]100[.]66[.]238:81 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
117[.]72[.]202[.]154:80 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
103[.]117[.]137[.]230:9999 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
121[.]43[.]194[.]200:8080 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
hxxps://vmi3554101[.]contaboserver[.]net/d4ndocs/gateway[.]php | Critical | 100/100 | Payload Delivery | โ | Associated with win.grandoreiro activity; source classification: payload_delivery. |
47[.]243[.]191[.]83:88 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
144[.]225[.]246[.]14:80 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
144[.]225[.]246[.]14:443 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
47[.]98[.]124[.]244:80 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
202[.]61[.]85[.]153:7800 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
202[.]61[.]85[.]153:7811 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
202[.]61[.]85[.]168:7800 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
202[.]61[.]85[.]168:7811 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
18[.]228[.]80[.]130:80 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.whitesnake activity; source classification: botnet_cc. |
105[.]72[.]55[.]52:8080 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.njrat activity; source classification: botnet_cc. |
8[.]148[.]27[.]183:12050 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.njrat activity; source classification: botnet_cc. |
stonestation[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
hxxp://a1308700[.]xsph[.]ru/L1nc0In[.]php | Critical | 100/100 | Botnet / C2 | โ | Associated with win.dcrat activity; source classification: botnet_cc. |
118[.]25[.]43[.]125:443 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
matie-bal[.]club | Critical | 100/100 | Botnet / C2 | โ | Associated with win.acr stealer activity; source classification: botnet_cc. |
hxxp://globalex[.]uz/gg/Panel/fre[.]php | Critical | 100/100 | Botnet / C2 | โ | Associated with win.lokipws activity; source classification: botnet_cc. |
willowbox[.]xyz | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
103[.]124[.]101[.]68:80 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.ghost rat activity; source classification: botnet_cc. |
198[.]23[.]185[.]239:80 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.ghost rat activity; source classification: botnet_cc. |
45[.]86[.]64[.]228:8080 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
118[.]175[.]159[.]92:8271 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.remus activity; source classification: botnet_cc. |
43[.]229[.]114[.]114:6669 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
187[.]101[.]57[.]177:1177 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.njrat activity; source classification: botnet_cc. |
relay[.]miranarts-top[.]cc | Critical | 100/100 | Botnet / C2 | Unknown RAT | Source classifies this indicator as unknown RAT activity. |
185[.]92[.]223[.]45:5892 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.remus activity; source classification: botnet_cc. |
prairielink[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
zouwemmig[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
ftp[.]sequences[.]digital | Critical | 100/100 | Botnet / C2 | โ | Associated with win.agent tesla activity; source classification: botnet_cc. |
kaliop-weda[.]club | Critical | 100/100 | Botnet / C2 | โ | Associated with win.acr stealer activity; source classification: botnet_cc. |
8[.]148[.]23[.]144:12329 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.njrat activity; source classification: botnet_cc. |
api[.]riklicidufiorai[.]com | Critical | 100/100 | Payload Delivery | โ | Source classifies this indicator under payload delivery. |
api[.]ketoriloxisd[.]com | Critical | 100/100 | Payload Delivery | โ | Source classifies this indicator under payload delivery. |
8[.]210[.]192[.]128:443 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
dnsrecordsarepowerful[.]com | Critical | 100/100 | Botnet / C2 | โ | Associated with apk.cecbot activity; source classification: botnet_cc. |
dontworry[.]su | Critical | 100/100 | Botnet / C2 | โ | Associated with apk.cecbot activity; source classification: botnet_cc. |
spamhaushackers[.]at | Critical | 100/100 | Botnet / C2 | โ | Associated with apk.cecbot activity; source classification: botnet_cc. |
youareafagifyoufoundthis[.]com | Critical | 100/100 | Botnet / C2 | โ | Associated with apk.cecbot activity; source classification: botnet_cc. |
cdn[.]tulipstone[.]cc | Critical | 100/100 | Botnet / C2 | โ | Associated with win.acr stealer activity; source classification: botnet_cc. |
tulipstone[.]cc | Critical | 100/100 | Botnet / C2 | โ | Associated with win.acr stealer activity; source classification: botnet_cc. |
43[.]228[.]157[.]171:2404 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.remcos activity; source classification: botnet_cc. |
43[.]166[.]202[.]32:80 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
192[.]252[.]187[.]52:357 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
192[.]252[.]187[.]52:358 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.valley rat activity; source classification: botnet_cc. |
bikecondition[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
deltawood[.]cc | Critical | 100/100 | Botnet / C2 | โ | Associated with win.acr stealer activity; source classification: botnet_cc. |
login[.]nimbusforge[.]cc | Critical | 100/100 | Botnet / C2 | โ | Associated with win.acr stealer activity; source classification: botnet_cc. |
creativex5[.]cc | Critical | 100/100 | Botnet / C2 | โ | Associated with win.acr stealer activity; source classification: botnet_cc. |
boss1huesos[.]cc | Critical | 100/100 | Botnet / C2 | โ | Associated with win.acr stealer activity; source classification: botnet_cc. |
194[.]87[.]97[.]249:6728 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.remus activity; source classification: botnet_cc. |
47[.]116[.]211[.]21:4782 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.quasar rat activity; source classification: botnet_cc. |
34[.]76[.]205[.]124:443 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.nanocore activity; source classification: botnet_cc. |
213[.]218[.]160[.]253:4444 | Critical | 100/100 | Botnet / C2 | โ | Associated with win.cobalt strike activity; source classification: botnet_cc. |
Source: User-provided IOC feed export dated 22 September 2026. Source confidence and original timestamps are retained in the GTI data layer for historical search.