CYBERRAKSHAK LABS · DAILY GLOBAL THREAT INTELLIGENCE
GTI Feed — 27 September 2026
100 indicators from the supplied daily feed, normalized for defensive publication with source confidence, threat type, malware/family and brief attack description.
Table format: IoC · Severity · Confidence · Involved Threat Type · Malware / Family · Brief Attack Description
| IoC | Severity | Confidence | Involved Threat Type | Malware / Family | Brief Attack Description |
|---|---|---|---|---|---|
| hxxp://cy911583[.]tw1[.]ru/L1nc0In[.]php | Critical | 100/100 | Botnet / C2 | DCRat | Source-associated botnet / c2 activity linked to DCRat. |
| ghostc2[.]thesmith[.]online | Critical | 100/100 | Botnet / C2 | Unknown | Source-associated botnet / c2 activity; family not identified in the supplied feed. |
| c2[.]thesmith[.]online | Critical | 100/100 | Botnet / C2 | Unknown | Source-associated botnet / c2 activity; family not identified in the supplied feed. |
| honeytrail[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| russetmoor[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| apricotrun[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| quiverlake[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| eee48[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| targetstore[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| boulderleaf[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| clovermark[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| dewberryhill[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| firgrove[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| sableyard[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| gw[.]quiverlake[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| status[.]russetmoor[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| beliefdesk[.]xyz | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source-associated botnet / c2 activity linked to Unknown Loader. |
| 13[.]140[.]59[.]149:443 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 46[.]250[.]228[.]119:1337 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 209[.]38[.]82[.]85:8443 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| hxxp://45[.]148[.]10[.]165:8843/check_in | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Source-associated botnet / c2 activity linked to Adaptix C2. |
| 15[.]204[.]253[.]8:8239 | Critical | 100/100 | Botnet / C2 | Remus | Source-associated botnet / c2 activity linked to Remus. |
| 172[.]94[.]46[.]114:1012 | Critical | 100/100 | Botnet / C2 | njRAT | Source-associated botnet / c2 activity linked to njRAT. |
| 137[.]184[.]108[.]14:3546 | Critical | 100/100 | Botnet / C2 | Remus | Source-associated botnet / c2 activity linked to Remus. |
| wss[.]scriptlab[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| sso[.]activeloop[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| 191[.]124[.]5[.]229:8443 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 47[.]109[.]48[.]152:443 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 210[.]16[.]168[.]11:9999 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 143[.]244[.]141[.]187:5003 | Critical | 100/100 | Botnet / C2 | Remus | Source-associated botnet / c2 activity linked to Remus. |
| 202[.]61[.]160[.]183:446 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| hxxp://212[.]109[.]218[.]20/gate[.]php | Critical | 100/100 | Botnet / C2 | Colibri | Source-associated botnet / c2 activity linked to Colibri. |
| 135[.]136[.]158[.]9:2430 | Critical | 100/100 | Botnet / C2 | Remcos | Source-associated botnet / c2 activity linked to Remcos. |
| 146[.]19[.]49[.]35:33474 | Critical | 100/100 | Botnet / C2 | RedLine Stealer | Source-associated botnet / c2 activity linked to RedLine Stealer. |
| 178[.]128[.]102[.]154:443 | Critical | 100/100 | Botnet / C2 | NanoCore | Source-associated botnet / c2 activity linked to NanoCore. |
| media[.]hazelnook[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| jamesmore02[.]work[.]gd | Critical | 100/100 | Botnet / C2 | Houdini | Source-associated botnet / c2 activity linked to Houdini. |
| brain[.]dynip[.]se | Critical | 100/100 | Botnet / C2 | Houdini | Source-associated botnet / c2 activity linked to Houdini. |
| secretopanel2[.]site | Critical | 100/100 | Botnet / C2 | Unknown | Source-associated botnet / c2 activity; family not identified in the supplied feed. |
| hxxps://secretopanel2[.]site/principal/aNuEntity[.]php | Critical | 100/100 | Botnet / C2 | Unknown | Source-associated botnet / c2 activity; family not identified in the supplied feed. |
| belieftrack[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source-associated botnet / c2 activity linked to Unknown Loader. |
| hxxps://vmi3554028[.]contaboserver[.]net/contador/2mNuEntity[.]php | Critical | 100/100 | Botnet / C2 | Astaroth | Source-associated botnet / c2 activity linked to Astaroth. |
| brasilengenhariaecom[.]store | Critical | 100/100 | Payload Delivery | Astaroth | Source-associated payload delivery activity linked to Astaroth. |
| vmi3554028[.]contaboserver | Critical | 100/100 | Botnet / C2 | Astaroth | Source-associated botnet / c2 activity linked to Astaroth. |
| sso[.]spookilyaqua[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| hxxps://moscow-never-sleep[.]com/ | Critical | 100/100 | Botnet / C2 | Unknown Stealer | Source-associated botnet / c2 activity linked to Unknown Stealer. |
| ziewqdsaw[.]cloud | Critical | 100/100 | Botnet / C2 | Unknown | Source-associated botnet / c2 activity; family not identified in the supplied feed. |
| hxxps://opusittobanditto[.]fun/sync | Critical | 100/100 | Botnet / C2 | Unknown | Source-associated botnet / c2 activity; family not identified in the supplied feed. |
| hxxps://opusittobanditto[.]fun/data | Critical | 100/100 | Botnet / C2 | Unknown | Source-associated botnet / c2 activity; family not identified in the supplied feed. |
| hxxps://api[.]localhost4000[.]fun/new | Critical | 100/100 | Botnet / C2 | Unknown | Source-associated botnet / c2 activity; family not identified in the supplied feed. |
| hxxps://perturabo40000[.]website/ | Critical | 100/100 | Botnet / C2 | Unknown | Source-associated botnet / c2 activity; family not identified in the supplied feed. |
| dhdhro456[.]gleeze[.]com | Critical | 100/100 | Botnet / C2 | LxBasErat | Source-associated botnet / c2 activity linked to LxBasErat. |
| lb[.]packetshift[.]cc | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| jetos[.]2waky[.]com | Critical | 100/100 | Botnet / C2 | StrRAT | Source-associated botnet / c2 activity linked to StrRAT. |
| cratebase[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source-associated botnet / c2 activity linked to Unknown Loader. |
| 103[.]42[.]30[.]245:6088 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| hxxp://45[.]91[.]226[.]120/getinstall64 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 1[.]12[.]59[.]176:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 47[.]114[.]83[.]19:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 145[.]79[.]143[.]4:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 47[.]97[.]199[.]23:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| hxxps://res[.]gridstack[.]cc/ | Critical | 100/100 | Botnet / C2 | ACR Stealer | Source-associated botnet / c2 activity linked to ACR Stealer. |
| 159[.]223[.]150[.]218:2538 | Critical | 100/100 | Botnet / C2 | Remus | Source-associated botnet / c2 activity linked to Remus. |
| nuypoiaklber[.]lol | Critical | 100/100 | Botnet / C2 | Unknown | Source-associated botnet / c2 activity; family not identified in the supplied feed. |
| hxxp://gaotlix[.]cn/getinstall64 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 43[.]224[.]224[.]72:7800 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 202[.]61[.]85[.]50:7800 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 202[.]61[.]85[.]50:7811 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 43[.]229[.]112[.]98:6667 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 192[.]253[.]228[.]137:7800 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 192[.]253[.]228[.]137:7811 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 154[.]82[.]92[.]12:7800 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 154[.]82[.]92[.]12:7811 | Critical | 100/100 | Botnet / C2 | ValleyRAT | Source-associated botnet / c2 activity linked to ValleyRAT. |
| 41[.]41[.]128[.]115:5005 | Critical | 100/100 | Botnet / C2 | Quasar RAT | Source-associated botnet / c2 activity linked to Quasar RAT. |
| hxxp://casasarticola[.]house/images/book/gate[.]php | Critical | 100/100 | Botnet / C2 | Pony | Source-associated botnet / c2 activity linked to Pony. |
| wishcourt[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source-associated botnet / c2 activity linked to Unknown Loader. |
| 121[.]43[.]58[.]113:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| hxxps://167[.]235[.]0[.]162/api/forensics | Critical | 100/100 | Botnet / C2 | Unknown | Source-associated botnet / c2 activity; family not identified in the supplied feed. |
| 45[.]145[.]228[.]161:9999 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 47[.]116[.]130[.]234:82 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 116[.]62[.]174[.]16:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 130[.]94[.]66[.]86:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| fallport[.]cfd | Critical | 100/100 | Botnet / C2 | Unknown Loader | Source-associated botnet / c2 activity linked to Unknown Loader. |
| 116[.]118[.]0[.]222:443 | Critical | 100/100 | Botnet / C2 | NanoCore | Source-associated botnet / c2 activity linked to NanoCore. |
| 47[.]122[.]120[.]188:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 101[.]34[.]208[.]175:8081 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 139[.]199[.]18[.]159:81 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 35[.]215[.]160[.]200:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 123[.]57[.]146[.]34:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 114[.]215[.]190[.]7:443 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| iwonderifulovemeaswell[.]vg | Critical | 100/100 | Botnet / C2 | CeCbot | Source-associated botnet / c2 activity linked to CeCbot. |
| lovefromallareas[.]at | Critical | 100/100 | Botnet / C2 | CeCbot | Source-associated botnet / c2 activity linked to CeCbot. |
| iloveuevenifudontlovemeback[.]is | Critical | 100/100 | Botnet / C2 | CeCbot | Source-associated botnet / c2 activity linked to CeCbot. |
| hxxps://103[.]101[.]85[.]26/gate | Critical | 100/100 | Botnet / C2 | Unknown | Source-associated botnet / c2 activity; family not identified in the supplied feed. |
| 106[.]54[.]201[.]103:9999 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 81[.]70[.]21[.]163:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 112[.]126[.]27[.]96:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 45[.]207[.]219[.]134:8080 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 81[.]70[.]21[.]163:8000 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
| 47[.]99[.]109[.]10:8080 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Source-associated botnet / c2 activity linked to Cobalt Strike. |
Source: User-provided IOC feed export dated 26 September 2026. The supplied feed identifies the 100 values as source-provided confidence; IOCs are defanged for safe publication.