Vivek Kumar, Lead Cybersecurity ConsultantVIVEK KUMAR
WAinYTIG๐•f
CYBERRAKSHAK LABS ยท DAILY GLOBAL THREAT INTELLIGENCE

GTI Feed โ€” 25 September 2026

100 indicators from the supplied daily feed, normalized for defensive publication with source confidence, threat type, malware/family and brief attack description.

Table format: IoC ยท Severity ยท Confidence ยท Involved Threat Type ยท Malware / Family ยท Brief Attack Description
IoCSeverityConfidenceInvolved Threat TypeMalware / FamilyBrief Attack Description
143[.]244[.]141[.]187:5003Critical**100**Botnet / C2RemusSource-associated botnet / c2 activity linked to Remus.
202[.]61[.]160[.]183:446Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
hxxp://212[.]109[.]218[.]20/gate[.]phpCritical**100**Botnet / C2ColibriSource-associated botnet / c2 activity linked to Colibri.
135[.]136[.]158[.]9:2430Critical**100**Botnet / C2RemcosSource-associated botnet / c2 activity linked to Remcos.
146[.]19[.]49[.]35:33474Critical**100**Botnet / C2RedLine StealerSource-associated botnet / c2 activity linked to RedLine Stealer.
178[.]128[.]102[.]154:443Critical**100**Botnet / C2NanoCoreSource-associated botnet / c2 activity linked to NanoCore.
media[.]hazelnook[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
jamesmore02[.]work[.]gdCritical**100**Botnet / C2HoudiniSource-associated botnet / c2 activity linked to Houdini.
brain[.]dynip[.]seCritical**100**Botnet / C2HoudiniSource-associated botnet / c2 activity linked to Houdini.
secretopanel2[.]siteCritical**100**Botnet / C2โ€”Source classification: botnet / c2.
hxxps://secretopanel2[.]site/principal/aNuEntity[.]phpCritical**100**Botnet / C2โ€”Source classification: botnet / c2.
belieftrack[.]cfdCritical**100**Botnet / C2Unknown LoaderSource-associated botnet / c2 activity linked to Unknown Loader.
hxxps://vmi3554028[.]contaboserver[.]net/contador/2mNuEntity[.]phpCritical**100**Botnet / C2AstarothSource-associated botnet / c2 activity linked to Astaroth.
brasilengenhariaecom[.]storeCritical**100**Payload DeliveryAstarothSource-associated payload delivery activity linked to Astaroth.
vmi3554028[.]contaboserverCritical**100**Botnet / C2AstarothSource-associated botnet / c2 activity linked to Astaroth.
sso[.]spookilyaqua[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
hxxps://moscow-never-sleep[.]com/Critical**100**Botnet / C2Unknown StealerSource-associated botnet / c2 activity linked to Unknown Stealer.
ziewqdsaw[.]cloudCritical**100**Botnet / C2โ€”Source classification: botnet / c2.
hxxps://opusittobanditto[.]fun/syncCritical**100**Botnet / C2โ€”Source classification: botnet / c2.
hxxps://opusittobanditto[.]fun/dataCritical**100**Botnet / C2โ€”Source classification: botnet / c2.
hxxps://api[.]localhost4000[.]fun/newCritical**100**Botnet / C2โ€”Source classification: botnet / c2.
hxxps://perturabo40000[.]website/Critical**100**Botnet / C2โ€”Source classification: botnet / c2.
dhdhro456[.]gleeze[.]comCritical**100**Botnet / C2LXBasERATSource-associated botnet / c2 activity linked to LXBasERAT.
lb[.]packetshift[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
jetos[.]2waky[.]comCritical**100**Botnet / C2STRRATSource-associated botnet / c2 activity linked to STRRAT.
cratebase[.]cfdCritical**100**Botnet / C2Unknown LoaderSource-associated botnet / c2 activity linked to Unknown Loader.
103[.]42[.]30[.]245:6088Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
hxxp://45[.]91[.]226[.]120/getinstall64Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
1[.]12[.]59[.]176:81Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
47[.]114[.]83[.]19:81Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
145[.]79[.]143[.]4:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
47[.]97[.]199[.]23:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
hxxps://res[.]gridstack[.]cc/Critical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
159[.]223[.]150[.]218:2538Critical**100**Botnet / C2RemusSource-associated botnet / c2 activity linked to Remus.
nuypoiaklber[.]lolCritical**100**Botnet / C2โ€”Source classification: botnet / c2.
hxxp://gaotlix[.]cn/getinstall64Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
43[.]224[.]224[.]72:7800Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
202[.]61[.]85[.]50:7800Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
202[.]61[.]85[.]50:7811Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
43[.]229[.]112[.]98:6667Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
192[.]253[.]228[.]137:7800Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
192[.]253[.]228[.]137:7811Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
154[.]82[.]92[.]12:7800Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
154[.]82[.]92[.]12:7811Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
41[.]41[.]128[.]115:5005Critical**100**Botnet / C2Quasar RATSource-associated botnet / c2 activity linked to Quasar RAT.
hxxp://casasarticola[.]house/images/book/gate[.]phpCritical**100**Botnet / C2PonySource-associated botnet / c2 activity linked to Pony.
wishcourt[.]cfdCritical**100**Botnet / C2Unknown LoaderSource-associated botnet / c2 activity linked to Unknown Loader.
121[.]43[.]58[.]113:81Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
hxxps://167[.]235[.]0[.]162/api/forensicsCritical**100**Botnet / C2โ€”Source classification: botnet / c2.
45[.]145[.]228[.]161:9999Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
47[.]116[.]130[.]234:82Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
116[.]62[.]174[.]16:81Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
130[.]94[.]66[.]86:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
fallport[.]cfdCritical**100**Botnet / C2Unknown LoaderSource-associated botnet / c2 activity linked to Unknown Loader.
116[.]118[.]0[.]222:443Critical**100**Botnet / C2NanoCoreSource-associated botnet / c2 activity linked to NanoCore.
47[.]122[.]120[.]188:81Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
101[.]34[.]208[.]175:8081Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
139[.]199[.]18[.]159:81Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
35[.]215[.]160[.]200:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
123[.]57[.]146[.]34:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
114[.]215[.]190[.]7:443Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
iwonderifulovemeaswell[.]vgCritical**100**Botnet / C2CeCbotSource-associated botnet / c2 activity linked to CeCbot.
lovefromallareas[.]atCritical**100**Botnet / C2CeCbotSource-associated botnet / c2 activity linked to CeCbot.
iloveuevenifudontlovemeback[.]isCritical**100**Botnet / C2CeCbotSource-associated botnet / c2 activity linked to CeCbot.
hxxps://103[.]101[.]85[.]26/gateCritical**100**Botnet / C2โ€”Source classification: botnet / c2.
106[.]54[.]201[.]103:9999Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
81[.]70[.]21[.]163:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
112[.]126[.]27[.]96:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
45[.]207[.]219[.]134:8080Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
81[.]70[.]21[.]163:8000Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
47[.]99[.]109[.]10:8080Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
friendsanchor[.]xyzCritical**100**Botnet / C2Unknown LoaderSource-associated botnet / c2 activity linked to Unknown Loader.
doctorboundary[.]xyzCritical**100**Botnet / C2Unknown LoaderSource-associated botnet / c2 activity linked to Unknown Loader.
queue[.]fastclimate[.]clickCritical**100**Botnet / C2โ€”Source classification: botnet / c2.
tndr-panel[.]onlineCritical**100**Botnet / C2โ€”Source classification: botnet / c2.
hxxps://tndr-panel[.]online/api[.]phpCritical**100**Botnet / C2โ€”Source classification: botnet / c2.
foldlodge[.]xyzCritical**100**Botnet / C2Unknown LoaderSource-associated botnet / c2 activity linked to Unknown Loader.
rmm[.]smartscreen[.]lifestyleCritical**100**Botnet / C2Unknown RATSource-associated botnet / c2 activity linked to Unknown RAT.
39[.]100[.]66[.]238:81Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
117[.]72[.]202[.]154:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
103[.]117[.]137[.]230:9999Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
121[.]43[.]194[.]200:8080Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
hxxps://vmi3554101[.]contaboserver[.]net/d4ndocs/gateway[.]phpCritical**100**Payload DeliveryGrandoreiroSource-associated payload delivery activity linked to Grandoreiro.
47[.]243[.]191[.]83:88Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
144[.]225[.]246[.]14:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
144[.]225[.]246[.]14:443Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
47[.]98[.]124[.]244:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
202[.]61[.]85[.]153:7800Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
202[.]61[.]85[.]153:7811Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
202[.]61[.]85[.]168:7800Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
202[.]61[.]85[.]168:7811Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
18[.]228[.]80[.]130:80Critical**100**Botnet / C2WhitesnakeSource-associated botnet / c2 activity linked to Whitesnake.
105[.]72[.]55[.]52:8080Critical**100**Botnet / C2NjratSource-associated botnet / c2 activity linked to Njrat.
8[.]148[.]27[.]183:12050Critical**100**Botnet / C2NjratSource-associated botnet / c2 activity linked to Njrat.
stonestation[.]cfdCritical**100**Botnet / C2Unknown LoaderSource-associated botnet / c2 activity linked to Unknown Loader.
hxxp://a1308700[.]xsph[.]ru/L1nc0In[.]phpCritical**100**Botnet / C2DcratSource-associated botnet / c2 activity linked to Dcrat.
118[.]25[.]43[.]125:443Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
matie-bal[.]clubCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
hxxp://globalex[.]uz/gg/Panel/fre[.]phpCritical**100**Botnet / C2LokipwsSource-associated botnet / c2 activity linked to Lokipws.
willowbox[.]xyzCritical**100**Botnet / C2Unknown LoaderSource-associated botnet / c2 activity linked to Unknown Loader.

Source: User-provided IOC feed export dated 25 September 2026. Source confidence and original timestamps are retained in the GTI data layer for historical search.

โ† Live GTI FeedGTI Archive โ†’