CYBERRAKSHAK LABS · DAILY GLOBAL THREAT INTELLIGENCE

GTI Feed — 29 September 2026

Daily defensive threat intelligence feed containing 100 source-provided, defanged indicators for 29 September 2026.

Table format: IoC · Severity · Confidence · Involved Threat Type · Malware / Family · Brief Attack Description

IoC	Severity	Confidence	Involved Threat Type	Malware / Family	Brief Attack Description
203[.]91[.]76[.]109:4368	Critical	100/100	Botnet / C2	ValleyRAT	Feed-classified botnet/C2 infrastructure associated with ValleyRAT.
154[.]36[.]188[.]124:8080	Critical	100/100	Botnet / C2	ValleyRAT	Feed-classified botnet/C2 infrastructure associated with ValleyRAT.
82[.]158[.]89[.]252:9178	Critical	100/100	Botnet / C2	ValleyRAT	Feed-classified botnet/C2 infrastructure associated with ValleyRAT.
77[.]37[.]41[.]59:9173	Critical	100/100	Botnet / C2	Remus	Feed-classified botnet/C2 infrastructure associated with Remus.
hxxp://54[.]46[.]28[.]247/getinstall64	Critical	100/100	Botnet / C2 URL	ValleyRAT	Feed-classified URL associated with ValleyRAT and botnet/C2 activity.
hxxp://43[.]199[.]224[.]15/getinstall64	Critical	100/100	Botnet / C2 URL	ValleyRAT	Feed-classified URL associated with ValleyRAT and botnet/C2 activity.
hxxp://43[.]106[.]102[.]167/getinstall64	Critical	100/100	Botnet / C2 URL	ValleyRAT	Feed-classified URL associated with ValleyRAT and botnet/C2 activity.
108[.]187[.]43[.]208:449	Critical	100/100	Botnet / C2	ValleyRAT	Feed-classified botnet/C2 infrastructure associated with ValleyRAT.
131[.]123[.]38[.]25:443	Critical	100/100	Botnet / C2	Nworm	Feed-classified botnet/C2 infrastructure associated with Nworm.
hxxps://thisisafalsepositive[.]st/shard/submitData	Critical	100/100	Botnet / C2 URL	Unknown RAT	Feed-classified URL associated with Unknown RAT and botnet/C2 activity.
hxxps://thisisafalsepositive[.]st/shard/submitFile	Critical	100/100	Botnet / C2 URL	Unknown RAT	Feed-classified URL associated with Unknown RAT and botnet/C2 activity.
hxxps://thisisafalsepositive[.]st/shard/submitWallet	Critical	100/100	Botnet / C2 URL	Unknown RAT	Feed-classified URL associated with Unknown RAT and botnet/C2 activity.
hxxps://thisisafalsepositive[.]st/shard/submitWalletFiles	Critical	100/100	Botnet / C2 URL	Unknown RAT	Feed-classified URL associated with Unknown RAT and botnet/C2 activity.
hxxps://thisisafalsepositive[.]st/shard/submitDiscordInjection	Critical	100/100	Botnet / C2 URL	Unknown RAT	Feed-classified URL associated with Unknown RAT and botnet/C2 activity.
hxxps://thisisafalsepositive[.]st/shard/submitLogs	Critical	100/100	Botnet / C2 URL	Unknown RAT	Feed-classified URL associated with Unknown RAT and botnet/C2 activity.
antimalwarediagnostics[.]st	Critical	100/100	Botnet / C2	Unknown RAT	Feed-classified botnet/C2 domain associated with Unknown RAT.
silentnet[.]st	Critical	100/100	Botnet / C2	Unknown RAT	Feed-classified botnet/C2 domain associated with Unknown RAT.
39[.]106[.]219[.]216:443	Critical	100/100	Botnet / C2	Cobalt Strike	Feed-classified botnet/C2 infrastructure associated with Cobalt Strike.
156[.]239[.]4[.]189:8081	Critical	100/100	Botnet / C2	Cobalt Strike	Feed-classified botnet/C2 infrastructure associated with Cobalt Strike.
8[.]148[.]241[.]203:443	Critical	100/100	Botnet / C2	Cobalt Strike	Feed-classified botnet/C2 infrastructure associated with Cobalt Strike.
123[.]60[.]102[.]111:443	Critical	100/100	Botnet / C2	Cobalt Strike	Feed-classified botnet/C2 infrastructure associated with Cobalt Strike.
hxxp://cy911583[.]tw1[.]ru/L1nc0In[.]php	Critical	100/100	Botnet / C2 URL	DCrat	Feed-classified URL associated with DCrat and botnet/C2 activity.
ghostc2[.]thesmith[.]online	Critical	100/100	Botnet / C2	—	Feed-classified botnet/C2 domain associated with Unknown.
c2[.]thesmith[.]online	Critical	100/100	Botnet / C2	—	Feed-classified botnet/C2 domain associated with Unknown.
honeytrail[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
russetmoor[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
apricotrun[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
quiverlake[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
eee48[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
targetstore[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
boulderleaf[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
clovermark[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
dewberryhill[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
firgrove[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
sableyard[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
gw[.]quiverlake[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
status[.]russetmoor[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
beliefdesk[.]xyz	Critical	100/100	Botnet / C2	Unknown Loader	Feed-classified botnet/C2 domain associated with Unknown Loader.
13[.]140[.]59[.]149:443	Critical	100/100	Botnet / C2	Cobalt Strike	Feed-classified botnet/C2 infrastructure associated with Cobalt Strike.
46[.]250[.]228[.]119:1337	Critical	100/100	Botnet / C2	Cobalt Strike	Feed-classified botnet/C2 infrastructure associated with Cobalt Strike.
209[.]38[.]82[.]85:8443	Critical	100/100	Botnet / C2	Cobalt Strike	Feed-classified botnet/C2 infrastructure associated with Cobalt Strike.
hxxp://45[.]148[.]10[.]165:8843/check_in	Critical	100/100	Botnet / C2 URL	adaptix_c2	Feed-classified URL associated with adaptix_c2 and botnet/C2 activity.
15[.]204[.]253[.]8:8239	Critical	100/100	Botnet / C2	Remus	Feed-classified botnet/C2 infrastructure associated with Remus.
172[.]94[.]46[.]114:1012	Critical	100/100	Botnet / C2	njRAT	Feed-classified botnet/C2 infrastructure associated with njRAT.
137[.]184[.]108[.]14:3546	Critical	100/100	Botnet / C2	Remus	Feed-classified botnet/C2 infrastructure associated with Remus.
wss[.]scriptlab[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
sso[.]activeloop[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
191[.]124[.]5[.]229:8443	Critical	100/100	Botnet / C2	Cobalt Strike	Feed-classified botnet/C2 infrastructure associated with Cobalt Strike.
47[.]109[.]48[.]152:443	Critical	100/100	Botnet / C2	Cobalt Strike	Feed-classified botnet/C2 infrastructure associated with Cobalt Strike.
210[.]16[.]168[.]11:9999	Critical	100/100	Botnet / C2	Cobalt Strike	Feed-classified botnet/C2 infrastructure associated with Cobalt Strike.
143[.]244[.]141[.]187:5003	Critical	100/100	Botnet / C2	Remus	Feed-classified botnet/C2 infrastructure associated with Remus.
202[.]61[.]160[.]183:446	Critical	100/100	Botnet / C2	ValleyRAT	Feed-classified botnet/C2 infrastructure associated with ValleyRAT.
hxxp://212[.]109[.]218[.]20/gate[.]php	Critical	100/100	Botnet / C2 URL	Colibri	Feed-classified URL associated with Colibri and botnet/C2 activity.
135[.]136[.]158[.]9:2430	Critical	100/100	Botnet / C2	Remcos	Feed-classified botnet/C2 infrastructure associated with Remcos.
146[.]19[.]49[.]35:33474	Critical	100/100	Botnet / C2	RedLine Stealer	Feed-classified botnet/C2 infrastructure associated with RedLine Stealer.
178[.]128[.]102[.]154:443	Critical	100/100	Botnet / C2	NanoCore	Feed-classified botnet/C2 infrastructure associated with NanoCore.
media[.]hazelnook[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
jamesmore02[.]work[.]gd	Critical	100/100	Botnet / C2	Houdini	Feed-classified botnet/C2 domain associated with Houdini.
brain[.]dynip[.]se	Critical	100/100	Botnet / C2	Houdini	Feed-classified botnet/C2 domain associated with Houdini.
secretopanel2[.]site	Critical	100/100	Botnet / C2	—	Feed-classified botnet/C2 domain associated with Unknown.
hxxps://secretopanel2[.]site/principal/aNuEntity[.]php	Critical	100/100	Botnet / C2 URL	—	Feed-classified URL associated with Unknown and botnet/C2 activity.
belieftrack[.]cfd	Critical	100/100	Botnet / C2	Unknown Loader	Feed-classified botnet/C2 domain associated with Unknown Loader.
hxxps://vmi3554028[.]contaboserver[.]net/contador/2mNuEntity[.]php	Critical	100/100	Botnet / C2 URL	Astaroth	Feed-classified URL associated with Astaroth and botnet/C2 activity.
brasilengenhariaecom[.]store	Critical	100/100	Botnet / C2	Astaroth	Feed-classified payload-delivery infrastructure associated with Astaroth.
vmi3554028[.]contaboserver	Critical	100/100	Botnet / C2	Astaroth	Feed-classified botnet/C2 domain associated with Astaroth.
sso[.]spookilyaqua[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
hxxps://moscow-never-sleep[.]com/	Critical	100/100	Botnet / C2 URL	Unknown Stealer	Feed-classified URL associated with Unknown Stealer and botnet/C2 activity.
ziewqdsaw[.]cloud	Critical	100/100	Botnet / C2	—	Feed-classified botnet/C2 domain associated with Unknown.
hxxps://opusittobanditto[.]fun/sync	Critical	100/100	Botnet / C2 URL	—	Feed-classified URL associated with Unknown and botnet/C2 activity.
hxxps://opusittobanditto[.]fun/data	Critical	100/100	Botnet / C2 URL	—	Feed-classified URL associated with Unknown and botnet/C2 activity.
hxxps://api[.]localhost4000[.]fun/new	Critical	100/100	Botnet / C2 URL	—	Feed-classified URL associated with Unknown and botnet/C2 activity.
hxxps://perturabo40000[.]website/	Critical	100/100	Botnet / C2 URL	—	Feed-classified URL associated with Unknown and botnet/C2 activity.
dhdhro456[.]gleeze[.]com	Critical	100/100	Botnet / C2	LxBaseRAT	Feed-classified botnet/C2 domain associated with LxBaseRAT.
lb[.]packetshift[.]cc	Critical	100/100	Botnet / C2	ACR Stealer	Feed-classified botnet/C2 domain associated with ACR Stealer.
jetos[.]2waky[.]com	Critical	100/100	Botnet / C2	STRRAT	Feed-classified botnet/C2 domain associated with STRRAT.
cratebase[.]cfd	Critical	100/100	Botnet / C2	Unknown Loader	Feed-classified botnet/C2 domain associated with Unknown Loader.
103[.]42[.]30[.]245:6088	Critical	100/100	Botnet / C2	ValleyRAT	Feed-classified botnet/C2 infrastructure associated with ValleyRAT.
hxxp://45[.]91[.]226[.]120/getinstall64	Critical	100/100	Botnet / C2 URL	ValleyRAT	Feed-classified URL associated with ValleyRAT and botnet/C2 activity.
1[.]12[.]59[.]176:81	Critical	100/100	Botnet / C2	Cobalt Strike	Feed-classified botnet/C2 infrastructure associated with Cobalt Strike.
47[.]114[.]83[.]19:81	Critical	100/100	Botnet / C2	Cobalt Strike	Feed-classified botnet/C2 infrastructure associated with Cobalt Strike.
145[.]79[.]143[.]4:80	Critical	100/100	Botnet / C2	Cobalt Strike	Feed-classified botnet/C2 infrastructure associated with Cobalt Strike.
47[.]97[.]199[.]23:80	Critical	100/100	Botnet / C2	Cobalt Strike	Feed-classified botnet/C2 infrastructure associated with Cobalt Strike.
hxxps://res[.]gridstack[.]cc/	Critical	100/100	Botnet / C2 URL	ACR Stealer	Feed-classified URL associated with ACR Stealer and botnet/C2 activity.
159[.]223[.]150[.]218:2538	Critical	100/100	Botnet / C2	Remus	Feed-classified botnet/C2 infrastructure associated with Remus.
nuypoiaklber[.]lol	Critical	100/100	Botnet / C2	—	Feed-classified botnet/C2 domain associated with Unknown.
hxxp://gaotlix[.]cn/getinstall64	Critical	100/100	Botnet / C2 URL	ValleyRAT	Feed-classified URL associated with ValleyRAT and botnet/C2 activity.
43[.]224[.]224[.]72:7800	Critical	100/100	Botnet / C2	ValleyRAT	Feed-classified botnet/C2 infrastructure associated with ValleyRAT.
202[.]61[.]85[.]50:7800	Critical	100/100	Botnet / C2	ValleyRAT	Feed-classified botnet/C2 infrastructure associated with ValleyRAT.
202[.]61[.]85[.]50:7811	Critical	100/100	Botnet / C2	ValleyRAT	Feed-classified botnet/C2 infrastructure associated with ValleyRAT.
43[.]229[.]112[.]98:6667	Critical	100/100	Botnet / C2	ValleyRAT	Feed-classified botnet/C2 infrastructure associated with ValleyRAT.
192[.]253[.]228[.]137:7800	Critical	100/100	Botnet / C2	ValleyRAT	Feed-classified botnet/C2 infrastructure associated with ValleyRAT.
192[.]253[.]228[.]137:7811	Critical	100/100	Botnet / C2	ValleyRAT	Feed-classified botnet/C2 infrastructure associated with ValleyRAT.
154[.]82[.]92[.]12:7800	Critical	100/100	Botnet / C2	ValleyRAT	Feed-classified botnet/C2 infrastructure associated with ValleyRAT.
154[.]82[.]92[.]12:7811	Critical	100/100	Botnet / C2	ValleyRAT	Feed-classified botnet/C2 infrastructure associated with ValleyRAT.
41[.]41[.]128[.]115:5005	Critical	100/100	Botnet / C2	Quasar RAT	Feed-classified botnet/C2 infrastructure associated with Quasar RAT.
hxxp://casasarticola[.]house/images/book/gate[.]php	Critical	100/100	Botnet / C2 URL	Pony	Feed-classified URL associated with Pony and botnet/C2 activity.
wishcourt[.]cfd	Critical	100/100	Botnet / C2	Unknown Loader	Feed-classified botnet/C2 domain associated with Unknown Loader.
121[.]43[.]58[.]113:81	Critical	100/100	Botnet / C2	Cobalt Strike	Feed-classified botnet/C2 infrastructure associated with Cobalt Strike.
hxxps://167[.]235[.]0[.]162/api/forensics	Critical	100/100	Botnet / C2 URL	—	Feed-classified URL associated with Unknown and botnet/C2 activity.
45[.]145[.]228[.]161:9999	Critical	100/100	Botnet / C2	Cobalt Strike	Feed-classified botnet/C2 infrastructure associated with Cobalt Strike.

Source: User-provided IOC feed export dated 26 September 2026. The supplied feed identifies the 100 values as source-provided confidence; IOCs are defanged for safe publication.

← Live GTI Feed GTI Archive →