CYBERRAKSHAK LABS ยท DAILY GLOBAL THREAT INTELLIGENCE
GTI Feed โ 24 September 2026
100 indicators from the supplied daily feed, normalized for defensive publication with source confidence, threat type, malware/family and brief attack description.
Table format: IoC ยท Severity ยท Confidence ยท Involved Threat Type ยท Malware / Family ยท Brief Attack Description
| IoC | Severity | Confidence | Involved Threat Type | Malware / Family | Brief Attack Description |
|---|---|---|---|---|---|
| belieftrack[.]cfd | Critical | 100/100 | Botnet / C2 | โ | Source-classified unknown loader activity. |
| hxxps://vmi3554028[.]contaboserver[.]net/contador/2mNuEntity[.]php | Critical | 100/100 | Botnet / C2 | Astaroth | Source-associated botnet / c2 activity linked to Astaroth. |
| brasilengenhariaecom[.]store | Critical | 100/100 | Payload Delivery | Astaroth | Source-associated payload delivery activity linked to Astaroth. |
| vmi3554028[.]contaboserver | Critical | 100/100 | Botnet / C2 | Astaroth | Source-associated botnet / c2 activity linked to Astaroth. |
| sso[.]spookilyaqua[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| hxxps://moscow-never-sleep[.]com/ | Critical | 100/100 | Botnet / C2 | โ | Source-classified unknown stealer activity. |
| ziewqdsaw[.]cloud | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
| hxxps://opusittobanditto[.]fun/sync | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
| hxxps://opusittobanditto[.]fun/data | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
| hxxps://api[.]localhost4000[.]fun/new | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
| hxxps://perturabo40000[.]website/ | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
| dhdhro456[.]gleeze[.]com | Critical | 100/100 | Botnet / C2 | LXBasERAT | Source-associated botnet / c2 activity linked to LXBasERAT. |
| lb[.]packetshift[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| jetos[.]2waky[.]com | Critical | 100/100 | Botnet / C2 | STRRAT | Source-associated botnet / c2 activity linked to STRRAT. |
| cratebase[.]cfd | Critical | 100/100 | Botnet / C2 | โ | Source-classified unknown loader activity. |
| 103[.]42[.]30[.]245:6088 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| hxxp://45[.]91[.]226[.]120/getinstall64 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 1[.]12[.]59[.]176:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 47[.]114[.]83[.]19:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 145[.]79[.]143[.]4:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 47[.]97[.]199[.]23:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| hxxps://res[.]gridstack[.]cc/ | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| 159[.]223[.]150[.]218:2538 | Critical | 100/100 | Botnet / C2 | Remus | Source-associated botnet / c2 activity linked to Remus. |
| nuypoiaklber[.]lol | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
| hxxp://gaotlix[.]cn/getinstall64 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 43[.]224[.]224[.]72:7800 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 202[.]61[.]85[.]50:7800 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 202[.]61[.]85[.]50:7811 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 43[.]229[.]112[.]98:6667 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 192[.]253[.]228[.]137:7800 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 192[.]253[.]228[.]137:7811 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 154[.]82[.]92[.]12:7800 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 154[.]82[.]92[.]12:7811 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 41[.]41[.]128[.]115:5005 | Critical | 100/100 | Botnet / C2 | Quasar RAT | Source-associated botnet / c2 activity linked to Quasar RAT. |
| hxxp://casasarticola[.]house/images/book/gate[.]php | Critical | 100/100 | Botnet / C2 | Pony | Source-associated botnet / c2 activity linked to Pony. |
| wishcourt[.]cfd | Critical | 100/100 | Botnet / C2 | โ | Source-classified unknown loader activity. |
| 121[.]43[.]58[.]113:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| hxxps://167[.]235[.]0[.]162/api/forensics | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
| 45[.]145[.]228[.]161:9999 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 47[.]116[.]130[.]234:82 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 116[.]62[.]174[.]16:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 130[.]94[.]66[.]86:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| fallport[.]cfd | Critical | 100/100 | Botnet / C2 | โ | Source-classified unknown loader activity. |
| 116[.]118[.]0[.]222:443 | Critical | 100/100 | Botnet / C2 | NanoCore | Source-associated botnet / c2 activity linked to NanoCore. |
| 47[.]122[.]120[.]188:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 101[.]34[.]208[.]175:8081 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 139[.]199[.]18[.]159:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 35[.]215[.]160[.]200:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 123[.]57[.]146[.]34:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 114[.]215[.]190[.]7:443 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| iwonderifulovemeaswell[.]vg | Critical | 100/100 | Botnet / C2 | CeCbot | Source-associated botnet / c2 activity linked to CeCbot. |
| lovefromallareas[.]at | Critical | 100/100 | Botnet / C2 | CeCbot | Source-associated botnet / c2 activity linked to CeCbot. |
| iloveuevenifudontlovemeback[.]is | Critical | 100/100 | Botnet / C2 | CeCbot | Source-associated botnet / c2 activity linked to CeCbot. |
| hxxps://103[.]101[.]85[.]26/gate | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
| 106[.]54[.]201[.]103:9999 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 81[.]70[.]21[.]163:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 112[.]126[.]27[.]96:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 45[.]207[.]219[.]134:8080 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 81[.]70[.]21[.]163:8000 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 47[.]99[.]109[.]10:8080 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| friendsanchor[.]xyz | Critical | 100/100 | Botnet / C2 | โ | Source-classified unknown loader activity. |
| doctorboundary[.]xyz | Critical | 100/100 | Botnet / C2 | โ | Source-classified unknown loader activity. |
| queue[.]fastclimate[.]click | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
| tndr-panel[.]online | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
| hxxps://tndr-panel[.]online/api[.]php | Critical | 100/100 | Botnet / C2 | โ | Source classification: botnet_cc. |
| foldlodge[.]xyz | Critical | 100/100 | Botnet / C2 | โ | Source-classified unknown loader activity. |
| rmm[.]smartscreen[.]lifestyle | Critical | 100/100 | Botnet / C2 | โ | Source-classified unknown RAT activity. |
| 39[.]100[.]66[.]238:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 117[.]72[.]202[.]154:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 103[.]117[.]137[.]230:9999 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 121[.]43[.]194[.]200:8080 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| hxxps://vmi3554101[.]contaboserver[.]net/d4ndocs/gateway[.]php | Critical | 100/100 | Payload Delivery | Grandoreiro | Source-associated payload delivery activity linked to Grandoreiro. |
| 47[.]243[.]191[.]83:88 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 144[.]225[.]246[.]14:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 144[.]225[.]246[.]14:443 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 47[.]98[.]124[.]244:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 202[.]61[.]85[.]153:7800 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 202[.]61[.]85[.]153:7811 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 202[.]61[.]85[.]168:7800 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 202[.]61[.]85[.]168:7811 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 18[.]228[.]80[.]130:80 | Critical | 100/100 | Botnet / C2 | WhiteSnake | Source-associated botnet / c2 activity linked to WhiteSnake. |
| 105[.]72[.]55[.]52:8080 | Critical | 100/100 | Botnet / C2 | njRAT | Source-associated botnet / c2 activity linked to njRAT. |
| 8[.]148[.]27[.]183:12050 | Critical | 100/100 | Botnet / C2 | njRAT | Source-associated botnet / c2 activity linked to njRAT. |
| stonestation[.]cfd | Critical | 100/100 | Botnet / C2 | โ | Source-classified unknown loader activity. |
| hxxp://a1308700[.]xsph[.]ru/L1nc0In[.]php | Critical | 100/100 | Botnet / C2 | DCRat | Source-associated botnet / c2 activity linked to DCRat. |
| 118[.]25[.]43[.]125:443 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| matie-bal[.]club | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| hxxp://globalex[.]uz/gg/Panel/fre[.]php | Critical | 100/100 | Botnet / C2 | LokiPWS | Source-associated botnet / c2 activity linked to LokiPWS. |
| willowbox[.]xyz | Critical | 100/100 | Botnet / C2 | โ | Source-classified unknown loader activity. |
| 103[.]124[.]101[.]68:80 | Critical | 100/100 | Botnet / C2 | Ghost RAT | Source-associated botnet / c2 activity linked to Ghost RAT. |
| 198[.]23[.]185[.]239:80 | Critical | 100/100 | Botnet / C2 | Ghost RAT | Source-associated botnet / c2 activity linked to Ghost RAT. |
| 45[.]86[.]64[.]228:8080 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 118[.]175[.]159[.]92:8271 | Critical | 100/100 | Botnet / C2 | Remus | Source-associated botnet / c2 activity linked to Remus. |
| 43[.]229[.]114[.]114:6669 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 187[.]101[.]57[.]177:1177 | Critical | 100/100 | Botnet / C2 | njRAT | Source-associated botnet / c2 activity linked to njRAT. |
| relay[.]miranarts-top[.]cc | Critical | 100/100 | Botnet / C2 | โ | Source-classified unknown RAT activity. |
| 185[.]92[.]223[.]45:5892 | Critical | 100/100 | Botnet / C2 | Remus | Source-associated botnet / c2 activity linked to Remus. |
| prairielink[.]cfd | Critical | 100/100 | Botnet / C2 | โ | Source-classified unknown loader activity. |
| zouwemmig[.]cfd | Critical | 100/100 | Botnet / C2 | โ | Source-classified unknown loader activity. |
| ftp[.]sequences[.]digital | Critical | 100/100 | Botnet / C2 | Agent Tesla | Source-associated botnet / c2 activity linked to Agent Tesla. |
Source: User-provided IOC feed export dated 24 September 2026. Source confidence and original timestamps are retained in the GTI data layer for historical search.