Vivek Kumar, Lead Cybersecurity ConsultantVIVEK KUMAR
WAinYTIG๐•f
CYBERRAKSHAK LABS ยท DAILY GLOBAL THREAT INTELLIGENCE

GTI Feed โ€” 26 September 2026

100 indicators from the supplied daily feed, normalized for defensive publication with source confidence, threat type, malware/family and brief attack description.

Table format: IoC ยท Severity ยท Confidence ยท Involved Threat Type ยท Malware / Family ยท Brief Attack Description
IoCSeverityConfidenceInvolved Threat TypeMalware / FamilyBrief Attack Description
honeytrail[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
russetmoor[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
apricotrun[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
quiverlake[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
eee48[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
targetstore[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
boulderleaf[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
clovermark[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
dewberryhill[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
firgrove[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
sableyard[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
gw[.]quiverlake[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
status[.]russetmoor[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
beliefdesk[.]xyzCritical**100**Botnet / C2Unknown LoaderSource-associated botnet / c2 activity linked to Unknown Loader.
13[.]140[.]59[.]149:443Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
46[.]250[.]228[.]119:1337Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
209[.]38[.]82[.]85:8443Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
hxxp://45[.]148[.]10[.]165:8843/check_inCritical**100**Botnet / C2Adaptix C2Source-associated botnet / c2 activity linked to Adaptix C2.
15[.]204[.]253[.]8:8239Critical**100**Botnet / C2RemusSource-associated botnet / c2 activity linked to Remus.
172[.]94[.]46[.]114:1012Critical**100**Botnet / C2NjratSource-associated botnet / c2 activity linked to Njrat.
137[.]184[.]108[.]14:3546Critical**100**Botnet / C2RemusSource-associated botnet / c2 activity linked to Remus.
wss[.]scriptlab[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
sso[.]activeloop[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
191[.]124[.]5[.]229:8443Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
47[.]109[.]48[.]152:443Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
210[.]16[.]168[.]11:9999Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
143[.]244[.]141[.]187:5003Critical**100**Botnet / C2RemusSource-associated botnet / c2 activity linked to Remus.
202[.]61[.]160[.]183:446Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
hxxp://212[.]109[.]218[.]20/gate[.]phpCritical**100**Botnet / C2ColibriSource-associated botnet / c2 activity linked to Colibri.
135[.]136[.]158[.]9:2430Critical**100**Botnet / C2RemcosSource-associated botnet / c2 activity linked to Remcos.
146[.]19[.]49[.]35:33474Critical**100**Botnet / C2RedLine StealerSource-associated botnet / c2 activity linked to RedLine Stealer.
178[.]128[.]102[.]154:443Critical**100**Botnet / C2NanoCoreSource-associated botnet / c2 activity linked to NanoCore.
media[.]hazelnook[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
jamesmore02[.]work[.]gdCritical**100**Botnet / C2HoudiniSource-associated botnet / c2 activity linked to Houdini.
brain[.]dynip[.]seCritical**100**Botnet / C2HoudiniSource-associated botnet / c2 activity linked to Houdini.
secretopanel2[.]siteCritical**100**Botnet / C2โ€”Source classification: botnet / c2 activity.
hxxps://secretopanel2[.]site/principal/aNuEntity[.]phpCritical**100**Botnet / C2โ€”Source classification: botnet / c2 activity.
belieftrack[.]cfdCritical**100**Botnet / C2Unknown LoaderSource-associated botnet / c2 activity linked to Unknown Loader.
hxxps://vmi3554028[.]contaboserver[.]net/contador/2mNuEntity[.]phpCritical**100**Botnet / C2AstarothSource-associated botnet / c2 activity linked to Astaroth.
brasilengenhariaecom[.]storeCritical**100**Payload DeliveryAstarothSource-associated payload delivery activity linked to Astaroth.
vmi3554028[.]contaboserverCritical**100**Botnet / C2AstarothSource-associated botnet / c2 activity linked to Astaroth.
sso[.]spookilyaqua[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
hxxps://moscow-never-sleep[.]com/Critical**100**Botnet / C2Unknown StealerSource-associated botnet / c2 activity linked to Unknown Stealer.
ziewqdsaw[.]cloudCritical**100**Botnet / C2โ€”Source classification: botnet / c2 activity.
hxxps://opusittobanditto[.]fun/syncCritical**100**Botnet / C2โ€”Source classification: botnet / c2 activity.
hxxps://opusittobanditto[.]fun/dataCritical**100**Botnet / C2โ€”Source classification: botnet / c2 activity.
hxxps://api[.]localhost4000[.]fun/newCritical**100**Botnet / C2โ€”Source classification: botnet / c2 activity.
hxxps://perturabo40000[.]website/Critical**100**Botnet / C2โ€”Source classification: botnet / c2 activity.
dhdhro456[.]gleeze[.]comCritical**100**Botnet / C2LXBasERATSource-associated botnet / c2 activity linked to LXBasERAT.
lb[.]packetshift[.]ccCritical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
jetos[.]2waky[.]comCritical**100**Botnet / C2STRRATSource-associated botnet / c2 activity linked to STRRAT.
cratebase[.]cfdCritical**100**Botnet / C2Unknown LoaderSource-associated botnet / c2 activity linked to Unknown Loader.
103[.]42[.]30[.]245:6088Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
hxxp://45[.]91[.]226[.]120/getinstall64Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
1[.]12[.]59[.]176:81Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
47[.]114[.]83[.]19:81Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
145[.]79[.]143[.]4:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
47[.]97[.]199[.]23:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
hxxps://res[.]gridstack[.]cc/Critical**100**Botnet / C2ACR StealerSource-associated botnet / c2 activity linked to ACR Stealer.
159[.]223[.]150[.]218:2538Critical**100**Botnet / C2RemusSource-associated botnet / c2 activity linked to Remus.
nuypoiaklber[.]lolCritical**100**Botnet / C2โ€”Source classification: botnet / c2 activity.
hxxp://gaotlix[.]cn/getinstall64Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
43[.]224[.]224[.]72:7800Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
202[.]61[.]85[.]50:7800Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
202[.]61[.]85[.]50:7811Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
43[.]229[.]112[.]98:6667Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
192[.]253[.]228[.]137:7800Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
192[.]253[.]228[.]137:7811Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
154[.]82[.]92[.]12:7800Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
154[.]82[.]92[.]12:7811Critical**100**Botnet / C2ValleyRATSource-associated botnet / c2 activity linked to ValleyRAT.
41[.]41[.]128[.]115:5005Critical**100**Botnet / C2Quasar RATSource-associated botnet / c2 activity linked to Quasar RAT.
hxxp://casasarticola[.]house/images/book/gate[.]phpCritical**100**Botnet / C2PonySource-associated botnet / c2 activity linked to Pony.
wishcourt[.]cfdCritical**100**Botnet / C2Unknown LoaderSource-associated botnet / c2 activity linked to Unknown Loader.
121[.]43[.]58[.]113:81Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
hxxps://167[.]235[.]0[.]162/api/forensicsCritical**100**Botnet / C2โ€”Source classification: botnet / c2 activity.
45[.]145[.]228[.]161:9999Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
47[.]116[.]130[.]234:82Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
116[.]62[.]174[.]16:81Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
130[.]94[.]66[.]86:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
fallport[.]cfdCritical**100**Botnet / C2Unknown LoaderSource-associated botnet / c2 activity linked to Unknown Loader.
116[.]118[.]0[.]222:443Critical**100**Botnet / C2NanoCoreSource-associated botnet / c2 activity linked to NanoCore.
47[.]122[.]120[.]188:81Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
101[.]34[.]208[.]175:8081Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
139[.]199[.]18[.]159:81Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
35[.]215[.]160[.]200:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
123[.]57[.]146[.]34:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
114[.]215[.]190[.]7:443Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
iwonderifulovemeaswell[.]vgCritical**100**Botnet / C2CeCbotSource-associated botnet / c2 activity linked to CeCbot.
lovefromallareas[.]atCritical**100**Botnet / C2CeCbotSource-associated botnet / c2 activity linked to CeCbot.
iloveuevenifudontlovemeback[.]isCritical**100**Botnet / C2CeCbotSource-associated botnet / c2 activity linked to CeCbot.
hxxps://103[.]101[.]85[.]26/gateCritical**100**Botnet / C2โ€”Source classification: botnet / c2 activity.
106[.]54[.]201[.]103:9999Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
81[.]70[.]21[.]163:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
112[.]126[.]27[.]96:80Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
45[.]207[.]219[.]134:8080Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
81[.]70[.]21[.]163:8000Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
47[.]99[.]109[.]10:8080Critical**100**Botnet / C2Cobalt StrikeSource-associated botnet / c2 activity linked to Cobalt Strike.
friendsanchor[.]xyzCritical**100**Botnet / C2Unknown LoaderSource-associated botnet / c2 activity linked to Unknown Loader.
doctorboundary[.]xyzCritical**100**Botnet / C2Unknown LoaderSource-associated botnet / c2 activity linked to Unknown Loader.
queue[.]fastclimate[.]clickCritical**100**Botnet / C2โ€”Source classification: botnet / c2 activity.

Source: User-provided IOC feed export dated 26 September 2026. The supplied feed identifies the 100 values as source-provided confidence; IOCs are defanged for safe publication.

โ† Live GTI FeedGTI Archive โ†’