CYBERRAKSHAK LABS · DAILY GLOBAL THREAT INTELLIGENCE
GTI Feed — 30 September 2026
Daily defensive threat intelligence feed containing 100 source-provided, defanged indicators for 30 September 2026.
Table format: IoC · Severity · Confidence · Involved Threat Type · Malware / Family · Brief Attack Description
| IoC | Severity | Confidence | Involved Threat Type | Malware / Family | Brief Attack Description |
|---|---|---|---|---|---|
| keatinginvestment[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| impressionist[.]ca | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| edenresources[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]apnaskiphireltd[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| iqraquranacademy[.]com[.]pk | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| deutsche-solar-boerse[.]de | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| inform[.]company | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| dramaacool[.]se | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| forwardphysiopt[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| globalhomesolutionsandsupply[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| insightsevents[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| hotmess2hotness[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]black-tower[.]cz | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]anticapianella[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]bogheseammentos[.]org | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| dmac[.]in | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]alffoundation[.]us | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]depannage-porte-sectionnelle[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| digiconf[.]hu | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]casenet[.]com[.]br | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]corsiscuola[.]eu | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]5g-become[.]eu | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| digmorewells[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]bedandbreakfastetma[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]antudo[.]info | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| discoverfriuli[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| digitalarise[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| demsystem[.]org | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]collegegardens[.]org | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| cuevasruraleseldescanso[.]es | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| donnahale[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]auto-passion-services[.]fr | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]airisktoday[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]cloverhillgatelodge[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| diplo-mover[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| discoveryourmoneypersonality[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| ardaas[.]co[.]uk | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| awilddream[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| bramptoncommercialkitchen[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| a-sam-design[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| casadastelegram[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| aqiqahku[.]co[.]id | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| awatoz[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| centralizedconsultingllc[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| beanblissltd[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| coderockets[.]academy | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| bossforward[.]org | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| 154[.]92[.]252[.]62:80 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Feed-classified botnet/C2 infrastructure associated with Adaptix C2. |
| 154[.]92[.]252[.]62:8080 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Feed-classified botnet/C2 infrastructure associated with Adaptix C2. |
| 154[.]92[.]252[.]62:443 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Feed-classified botnet/C2 infrastructure associated with Adaptix C2. |
| kwwen7ef[.]imzural[.]info | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| dy0iwfp0[.]privateautomation[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| h1aqjs00[.]roxymigurdia[.]wiki | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| privateautomation[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| hxxps://frameworkservice[.]online/ | Critical | 100/100 | Botnet / C2 URL | Unknown | Feed-associated payload delivery activity. |
| bluroofing[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| abbaproyectosca[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| adamgant[.]net | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| chestnutgrovecapital[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| candcins[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| 317lights[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| beautylabosielsko[.]pl | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| 110digitech[.]com[.]au | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| ddebeni[.]edu[.]bo | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| c2-products[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| anothershittytravelblog[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| craftedcollector[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| arcworld[.]de | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| chardikalaempowerment[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| customguitarbuilder[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| careycustomhomes[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| bcsfab[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| ddhadvisory[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| cobra-studio[.]co[.]il | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| adriandubiel[.]press | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| adrian-dubiel[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| advensystem[.]lu | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| coreabilitycare[.]org | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| daggalma[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| cenexmedical[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| alpicool[.]no | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| cuxgarten[.]de | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| birumut[.]org | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| frameworkservice[.]online | Critical | 100/100 | Payload Delivery | Unknown | Feed-associated payload delivery activity. |
| www[.]smokee[.]ch | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| motherload[.]me | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]teresariba[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| xt[.]32naga[.]net | Critical | 100/100 | Botnet / C2 | Vidar | Feed-classified botnet/C2 infrastructure associated with Vidar. |
| hxxps://xt[.]32naga[.]net/ | Critical | 100/100 | Botnet / C2 URL | Vidar | Feed-classified botnet/C2 infrastructure associated with Vidar. |
| xt[.]5-rt[.]org | Critical | 100/100 | Botnet / C2 | Vidar | Feed-classified botnet/C2 infrastructure associated with Vidar. |
| hxxps://xt[.]5-rt[.]org/ | Critical | 100/100 | Botnet / C2 URL | Vidar | Feed-classified botnet/C2 infrastructure associated with Vidar. |
| alicias-beauty[.]ch | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| travel4u[.]ch | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| www[.]joanacosta[.]ca | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| eaglewinggulf[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| sts[.]ch | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| mg[.]fastanswerinc[.]club | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| rabinpack[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| oe808fbgbub[.]preview[.]infomaniak[.]website | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
| galaxyau[.]ai | Critical | 100/100 | Payload Delivery | ClearFake | Feed-classified payload-delivery infrastructure associated with ClearFake. |
Source: User-provided IOC feed export dated 26 September 2026. The supplied feed identifies the 100 values as source-provided confidence; IOCs are defanged for safe publication.