CYBERRAKSHAK LABS ยท DAILY GLOBAL THREAT INTELLIGENCE
GTI Feed โ 23 September 2026
100 indicators from the supplied daily feed, normalized for defensive publication with source confidence, threat type, malware/family and brief attack description.
Table format: IoC ยท Severity ยท Confidence ยท Involved Threat Type ยท Malware / Family ยท Brief Attack Description
| IoC | Severity | Confidence | Involved Threat Type | Malware / Family | Brief Attack Description |
|---|---|---|---|---|---|
ziewqdsaw[.]cloud | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
hxxps://opusittobanditto[.]fun/sync | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
hxxps://opusittobanditto[.]fun/data | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
hxxps://api[.]localhost4000[.]fun/new | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
hxxps://perturabo40000[.]website/ | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
dhdhro456[.]gleeze[.]com | Critical | 100/100 | Botnet / C2 | โ | Associated with win.lxbaserat activity; source classification: botnet_cc. |
lb[.]packetshift[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Associated with win.acr stealer activity; source classification: botnet_cc. |
jetos[.]2waky[.]com | Critical | 100/100 | Botnet / C2 | STRRAT | Associated with jar.strrat activity; source classification: botnet_cc. |
cratebase[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
103[.]42[.]30[.]245:6088 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
hxxp://45[.]91[.]226[.]120/getinstall64 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
1[.]12[.]59[.]176:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
47[.]114[.]83[.]19:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
145[.]79[.]143[.]4:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
47[.]97[.]199[.]23:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
hxxps://res[.]gridstack[.]cc/ | Critical | 100/100 | Botnet / C2 | ACR Stealer | Associated with win.acr stealer activity; source classification: botnet_cc. |
159[.]223[.]150[.]218:2538 | Critical | 100/100 | Botnet / C2 | Remus | Associated with win.remus activity; source classification: botnet_cc. |
nuypoiaklber[.]lol | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
hxxp://gaotlix[.]cn/getinstall64 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
43[.]224[.]224[.]72:7800 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
202[.]61[.]85[.]50:7800 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
202[.]61[.]85[.]50:7811 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
43[.]229[.]112[.]98:6667 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
192[.]253[.]228[.]137:7800 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
192[.]253[.]228[.]137:7811 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
154[.]82[.]92[.]12:7800 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
154[.]82[.]92[.]12:7811 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
41[.]41[.]128[.]115:5005 | Critical | 100/100 | Botnet / C2 | Quasar RAT | Associated with win.quasar rat activity; source classification: botnet_cc. |
hxxp://casasarticola[.]house/images/book/gate[.]php | Critical | 100/100 | Botnet / C2 | Pony | Associated with win.pony activity; source classification: botnet_cc. |
wishcourt[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
121[.]43[.]58[.]113:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
hxxps://167[.]235[.]0[.]162/api/forensics | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
45[.]145[.]228[.]161:9999 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
47[.]116[.]130[.]234:82 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
116[.]62[.]174[.]16:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
130[.]94[.]66[.]86:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
fallport[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
116[.]118[.]0[.]222:443 | Critical | 100/100 | Botnet / C2 | NanoCore | Associated with win.nanocore activity; source classification: botnet_cc. |
47[.]122[.]120[.]188:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
101[.]34[.]208[.]175:8081 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
139[.]199[.]18[.]159:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
35[.]215[.]160[.]200:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
123[.]57[.]146[.]34:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
114[.]215[.]190[.]7:443 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
iwonderifulovemeaswell[.]vg | Critical | 100/100 | Botnet / C2 | CeCbot | Associated with apk.cecbot activity; source classification: botnet_cc. |
lovefromallareas[.]at | Critical | 100/100 | Botnet / C2 | CeCbot | Associated with apk.cecbot activity; source classification: botnet_cc. |
iloveuevenifudontlovemeback[.]is | Critical | 100/100 | Botnet / C2 | CeCbot | Associated with apk.cecbot activity; source classification: botnet_cc. |
hxxps://103[.]101[.]85[.]26/gate | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
106[.]54[.]201[.]103:9999 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
81[.]70[.]21[.]163:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
112[.]126[.]27[.]96:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
45[.]207[.]219[.]134:8080 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
81[.]70[.]21[.]163:8000 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
47[.]99[.]109[.]10:8080 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
friendsanchor[.]xyz | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
doctorboundary[.]xyz | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
queue[.]fastclimate[.]click | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
tndr-panel[.]online | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
hxxps://tndr-panel[.]online/api[.]php | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
foldlodge[.]xyz | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
rmm[.]smartscreen[.]lifestyle | Critical | 100/100 | Botnet / C2 | Unknown RAT | Source classifies this indicator as unknown RAT activity. |
39[.]100[.]66[.]238:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
117[.]72[.]202[.]154:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
103[.]117[.]137[.]230:9999 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
121[.]43[.]194[.]200:8080 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
hxxps://vmi3554101[.]contaboserver[.]net/d4ndocs/gateway[.]php | Critical | 100/100 | Payload Delivery | Grandoreiro | Associated with win.grandoreiro activity; source classification: payload_delivery. |
47[.]243[.]191[.]83:88 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
144[.]225[.]246[.]14:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
144[.]225[.]246[.]14:443 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
47[.]98[.]124[.]244:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
202[.]61[.]85[.]153:7800 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
202[.]61[.]85[.]153:7811 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
202[.]61[.]85[.]168:7800 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
202[.]61[.]85[.]168:7811 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
18[.]228[.]80[.]130:80 | Critical | 100/100 | Botnet / C2 | WhiteSnake | Associated with win.whitesnake activity; source classification: botnet_cc. |
105[.]72[.]55[.]52:8080 | Critical | 100/100 | Botnet / C2 | njRAT | Associated with win.njrat activity; source classification: botnet_cc. |
8[.]148[.]27[.]183:12050 | Critical | 100/100 | Botnet / C2 | njRAT | Associated with win.njrat activity; source classification: botnet_cc. |
stonestation[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
hxxp://a1308700[.]xsph[.]ru/L1nc0In[.]php | Critical | 100/100 | Botnet / C2 | DCRat | Associated with win.dcrat activity; source classification: botnet_cc. |
118[.]25[.]43[.]125:443 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
matie-bal[.]club | Critical | 100/100 | Botnet / C2 | ACR Stealer | Associated with win.acr stealer activity; source classification: botnet_cc. |
hxxp://globalex[.]uz/gg/Panel/fre[.]php | Critical | 100/100 | Botnet / C2 | LokiPWS | Associated with win.lokipws activity; source classification: botnet_cc. |
willowbox[.]xyz | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
103[.]124[.]101[.]68:80 | Critical | 100/100 | Botnet / C2 | Gh0st RAT | Associated with win.ghost rat activity; source classification: botnet_cc. |
198[.]23[.]185[.]239:80 | Critical | 100/100 | Botnet / C2 | Gh0st RAT | Associated with win.ghost rat activity; source classification: botnet_cc. |
45[.]86[.]64[.]228:8080 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt strike activity; source classification: botnet_cc. |
118[.]175[.]159[.]92:8271 | Critical | 100/100 | Botnet / C2 | Remus | Associated with win.remus activity; source classification: botnet_cc. |
43[.]229[.]114[.]114:6669 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
187[.]101[.]57[.]177:1177 | Critical | 100/100 | Botnet / C2 | njRAT | Associated with win.njrat activity; source classification: botnet_cc. |
relay[.]miranarts-top[.]cc | Critical | 100/100 | Botnet / C2 | Unknown RAT | Source classifies this indicator as unknown RAT activity. |
185[.]92[.]223[.]45:5892 | Critical | 100/100 | Botnet / C2 | Remus | Associated with win.remus activity; source classification: botnet_cc. |
prairielink[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
zouwemmig[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source classifies this indicator as unknown loader activity. |
ftp[.]sequences[.]digital | Critical | 100/100 | Botnet / C2 | Agent Tesla | Associated with win.agent tesla activity; source classification: botnet_cc. |
kaliop-weda[.]club | Critical | 100/100 | Botnet / C2 | ACR Stealer | Associated with win.acr stealer activity; source classification: botnet_cc. |
8[.]148[.]23[.]144:12329 | Critical | 100/100 | Botnet / C2 | njRAT | Associated with win.njrat activity; source classification: botnet_cc. |
api[.]riklicidufiorai[.]com | Critical | 100/100 | Payload Delivery | โ | Source classifies this indicator under payload delivery. |
api[.]ketoriloxisd[.]com | Critical | 100/100 | Payload Delivery | โ | Source classifies this indicator under payload delivery. |
8[.]210[.]192[.]128:443 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Associated with win.valley rat activity; source classification: botnet_cc. |
dnsrecordsarepowerful[.]com | Critical | 100/100 | Botnet / C2 | CeCbot | Associated with apk.cecbot activity; source classification: botnet_cc. |
Source: User-provided IOC feed export dated 23 September 2026. Source confidence and original timestamps are retained in the GTI data layer for historical search.