CYBERRAKSHAK LABS · DAILY GLOBAL THREAT INTELLIGENCE
GTI Feed — 30 September 2026
Daily defensive threat intelligence feed containing 100 source-provided, defanged indicators for 30 September 2026.
Table format: IoC · Severity · Confidence · Involved Threat Type · Malware / Family · Brief Attack Description
| IoC | Severity | Confidence | Involved Threat Type | Malware / Family | Brief Attack Description |
|---|---|---|---|---|---|
| 148[.]66[.]17[.]122:60001 | Critical | 100/100 | Botnet / C2 | VShell | Associated with win.vshell activity; source classification: botnet_cc. |
| 37[.]120[.]238[.]187:8080 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt_strike activity; source classification: botnet_cc. |
| 185[.]233[.]164[.]83:3306 | Critical | 100/100 | Botnet / C2 | Quasar RAT | Associated with win.quasar_rat activity; source classification: botnet_cc. |
| www[.]helivision[.]no | Critical | 90/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| 37[.]120[.]238[.]187:80 | Critical | 100/100 | Botnet / C2 | Cobalt Strike | Associated with win.cobalt_strike activity; source classification: botnet_cc. |
| browseid[.]codes | Critical | 90/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| wordpress[.]pullstack[.]cloud | Critical | 90/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| 134[.]175[.]40[.]200:3232 | Critical | 100/100 | Botnet / C2 | Unknown | Source classification: botnet_cc. |
| 113[.]20[.]0[.]225:2096 | Critical | 100/100 | Botnet / C2 | VShell | Associated with win.vshell activity; source classification: botnet_cc. |
| 103[.]115[.]49[.]68:4993 | Critical | 100/100 | Botnet / C2 | Unknown | Source classification: botnet_cc. |
| 13[.]143[.]134[.]71:80 | Critical | 100/100 | Botnet / C2 | AsyncRAT | Associated with win.asyncrat activity; source classification: botnet_cc. |
| 130[.]94[.]67[.]107:7443 | Critical | 100/100 | Botnet / C2 | Unknown | Source classification: botnet_cc. |
| hxxps://up[.]332toto[.]net/ | Critical | 100/100 | Botnet / C2 | Vidar | Associated with win.vidar activity; source classification: botnet_cc. |
| up[.]369jk[.]org | Critical | 100/100 | Botnet / C2 | Vidar | Associated with win.vidar activity; source classification: botnet_cc. |
| hxxps://up[.]369jk[.]org/ | Critical | 100/100 | Botnet / C2 | Vidar | Associated with win.vidar activity; source classification: botnet_cc. |
| up[.]332toto[.]net | Critical | 100/100 | Botnet / C2 | Vidar | Associated with win.vidar activity; source classification: botnet_cc. |
| notzen[.]xyz | Critical | 90/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| 110[.]42[.]111[.]42:8008 | Critical | 100/100 | Botnet / C2 | Quasar RAT | Associated with win.quasar_rat activity; source classification: botnet_cc. |
| 36[.]255[.]97[.]19:2404 | Critical | 100/100 | Botnet / C2 | Remcos | Associated with win.remcos activity; source classification: botnet_cc. |
| 45[.]43[.]163[.]202:4782 | Critical | 100/100 | Botnet / C2 | Quasar RAT | Associated with win.quasar_rat activity; source classification: botnet_cc. |
| 103[.]115[.]49[.]68:3232 | Critical | 100/100 | Botnet / C2 | Unknown | Source classification: botnet_cc. |
| 044shs8u[.]tapkita[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| test[.]barnabe[.]ch | Critical | 90/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| zdwtkug8[.]sylphiette[.]baby | Critical | 100/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| f2vxl7ys[.]thehairnetshop[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| thehairnetshop[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| tantrikashaman[.]com | Critical | 90/100 | Payload Delivery | Unknown | Source classification: payload_delivery. |
| camilagazola[.]com[.]br | Critical | 90/100 | Payload Delivery | Unknown | Source classification: payload_delivery. |
| 54[.]173[.]174[.]159:8080 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Associated with win.adaptix_c2 activity; source classification: botnet_cc. |
| 54[.]173[.]174[.]159:80 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Associated with win.adaptix_c2 activity; source classification: botnet_cc. |
| 47[.]130[.]215[.]99:8080 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Associated with win.adaptix_c2 activity; source classification: botnet_cc. |
| 52[.]22[.]15[.]69:80 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Associated with win.adaptix_c2 activity; source classification: botnet_cc. |
| 47[.]130[.]215[.]99:80 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Associated with win.adaptix_c2 activity; source classification: botnet_cc. |
| jet[.]bowlinggreenwinnelsonco[.]com | Critical | 90/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| 35[.]179[.]92[.]211:80 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Associated with win.adaptix_c2 activity; source classification: botnet_cc. |
| 35[.]179[.]92[.]211:8080 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Associated with win.adaptix_c2 activity; source classification: botnet_cc. |
| 20[.]220[.]105[.]236:8080 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Associated with win.adaptix_c2 activity; source classification: botnet_cc. |
| www[.]beltranswebcam[.]com | Critical | 90/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| 15fc73d7[.]wignalllindor[.]wiki | Critical | 90/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| 20[.]220[.]105[.]236:80 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Associated with win.adaptix_c2 activity; source classification: botnet_cc. |
| 18[.]143[.]169[.]148:8080 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Associated with win.adaptix_c2 activity; source classification: botnet_cc. |
| www[.]5a71[.]com | Critical | 90/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| www[.]altinvadicatering[.]com | Critical | 90/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| www[.]autosy[.]se | Critical | 90/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| ufuoew6n[.]tanyavondegurechaff[.]fit | Critical | 100/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| 18[.]143[.]169[.]148:80 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Associated with win.adaptix_c2 activity; source classification: botnet_cc. |
| 13[.]214[.]130[.]115:8080 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Associated with win.adaptix_c2 activity; source classification: botnet_cc. |
| 13[.]214[.]130[.]115:80 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Associated with win.adaptix_c2 activity; source classification: botnet_cc. |
| wssc[.]flavorroute[.]cc | Critical | 90/100 | Payload Delivery | Unknown | Source classification: payload_delivery. |
| lo[.]369jk[.]org | Critical | 100/100 | Botnet / C2 | Vidar | Associated with win.vidar activity; source classification: botnet_cc. |
| hxxps://lo[.]369jk[.]org/ | Critical | 100/100 | Botnet / C2 | Vidar | Associated with win.vidar activity; source classification: botnet_cc. |
| lo[.]332toto[.]net | Critical | 100/100 | Botnet / C2 | Vidar | Associated with win.vidar activity; source classification: botnet_cc. |
| hxxps://lo[.]332toto[.]net/ | Critical | 100/100 | Botnet / C2 | Vidar | Associated with win.vidar activity; source classification: botnet_cc. |
| b4jy90mg[.]succeswithpaul[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| 6cbfarwv[.]telizant[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| telizant[.]com | Critical | 100/100 | Payload Delivery | ClearFake | Associated with js.clearfake activity; source classification: payload_delivery. |
| 139[.]180[.]222[.]135:80 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Associated with win.adaptix_c2 activity; source classification: botnet_cc. |
| 139[.]180[.]222[.]135:8080 | Critical | 100/100 | Botnet / C2 | Adaptix C2 | Associated with win.adaptix_c2 activity; source classification: botnet_cc. |
| 104[.]234[.]94[.]198:1144 | Critical | 100/100 | Botnet / C2 | Unknown Loader | Associated with unknown_loader activity; source classification: botnet_cc. |
| 107[.]182[.]130[.]226:1144 | Critical | 100/100 | Botnet / C2 | Unknown Loader | Associated with unknown_loader activity; source classification: botnet_cc. |
| hxxp://84[.]200[.]33[.]163/302/302m | Critical | 100/100 | Payload Delivery | Contagious Drop | Associated with js.contagious_drop activity; source classification: payload_delivery. |
| hxxp://84[.]200[.]33[.]163/302/302l | Critical | 100/100 | Payload Delivery | Contagious Drop | Associated with js.contagious_drop activity; source classification: payload_delivery. |
| hxxp://84[.]200[.]33[.]163/302/302w | Critical | 100/100 | Payload Delivery | Contagious Drop | Associated with js.contagious_drop activity; source classification: payload_delivery. |
| hxxp://84[.]200[.]33[.]163/302/tokenlinux[.]sh | Critical | 100/100 | Payload Delivery | Contagious Drop | Associated with js.contagious_drop activity; source classification: payload_delivery. |
| hxxp://84[.]200[.]33[.]163/302/parser[.]js | Critical | 100/100 | Payload Delivery | Contagious Drop | Associated with js.contagious_drop activity; source classification: payload_delivery. |
| 9522e6bf4b6291f15acfff7b7340434309e0e4ae3855f717d7a0ffce5a126c24 | Critical | 100/100 | Payload | Contagious Drop | Associated with js.contagious_drop activity; source classification: payload. |
| 09192b6e580fbad5ddbf4fec15fd90eca678ac060f232bdc1da67c029842c35a | Critical | 100/100 | Payload | Contagious Drop | Associated with js.contagious_drop activity; source classification: payload. |
| 6497f4d0c65e56b12ea4dfd170bfac891cf8b4612fa4e8fa4825cb59a8b96ea8 | Critical | 100/100 | Payload | Contagious Drop | Associated with js.contagious_drop activity; source classification: payload. |
| bde5c02bb3b72f8a5564a63b56337cffec5f2052d7f78d123269dd55125ba0c9 | Critical | 100/100 | Payload | Contagious Drop | Associated with js.contagious_drop activity; source classification: payload. |
| 47c0d92b76fc8399a217da9e169042ee66639bb84da848e6db259736f30320b0 | Critical | 100/100 | Payload | Contagious Drop | Associated with js.contagious_drop activity; source classification: payload. |
| 055c299bc45467b10f65131c8f3118e42844565022e4cac3f22f531884c7f9ee | Critical | 100/100 | Payload | Contagious Drop | Associated with js.contagious_drop activity; source classification: payload. |
| 3635ee889c55579c417141237e13b5014b7296f2926d310a67c5e4a61046bd81 | Critical | 100/100 | Payload | Unknown Loader | Associated with unknown_loader activity; source classification: payload. |
| ea4a3e4fe0d0f6dba84c11e0bd9a2bc8ad5fbc1d75d323b51bdf3a22ef5e7251 | Critical | 100/100 | Payload | AMOS | Associated with osx.amos activity; source classification: payload. |
| 45[.]146[.]91[.]234:7061 | Critical | 100/100 | Botnet / C2 | Drifter | Associated with elf.drifter activity; source classification: botnet_cc. |
| 109[.]107[.]189[.]252:7061 | Critical | 100/100 | Botnet / C2 | Drifter | Associated with elf.drifter activity; source classification: botnet_cc. |
| 45[.]146[.]91[.]241:7061 | Critical | 100/100 | Botnet / C2 | Drifter | Associated with elf.drifter activity; source classification: botnet_cc. |
| 84[.]200[.]33[.]163:80 | Critical | 100/100 | Payload Delivery | Contagious Drop | Associated with js.contagious_drop activity; source classification: payload_delivery. |
| 33e97dd40b3f1bcb68d265121a10a40b20496e3a1c768bc1ec00e820a02e2e5f | Critical | 100/100 | Payload | BashLite | Associated with elf.bashlite activity; source classification: payload. |
| a3a420313870af122bdc8ecd1780d9e38ea95e25cc8bf35c18abfd05ee645bd0 | Critical | 100/100 | Payload | BashLite | Associated with elf.bashlite activity; source classification: payload. |
| 46acef521bbdfe7924a9f20267d9270d4cb3dc5d47f17b1e384c31a69df4af5e | Critical | 100/100 | Payload | Mirai | Associated with elf.mirai activity; source classification: payload. |
| 0cfccf7555d6fe96a0e51f3e8238774821c24081c595d66294d44657c13a84fe | Critical | 100/100 | Payload | Mirai | Associated with elf.mirai activity; source classification: payload. |
| ccab0ec1753714357c97db2d0ae3e27fd6e43b1d1cf45fcf5f4ab6f944a4f672 | Critical | 100/100 | Payload | Mirai | Associated with elf.mirai activity; source classification: payload. |
| 856dafff407326c83dcff6c439b961df8ce34af653b4d093f1221bcba478ab27 | Critical | 100/100 | Payload | Mirai | Associated with elf.mirai activity; source classification: payload. |
| a8af15d9e99a5fa5d6e92a6fd66d7233123c4c5f395edbb13d772c75600dec24 | Critical | 100/100 | Payload | Mirai | Associated with elf.mirai activity; source classification: payload. |
| 652f9eee319df03afbf2ec9a8ed7348d731748a7e6063940609c027501ede548 | Critical | 100/100 | Payload | BashLite | Associated with elf.bashlite activity; source classification: payload. |
| 37bbd450764f6225a61b5a57ce7174d39f1d55bbe05a8c43ad96f38c9bc66b1e | Critical | 100/100 | Payload | Mirai | Associated with elf.mirai activity; source classification: payload. |
| 896739f406f9e7bc1e3746e5a34b7e5f4b136a7e5728df22a7818c50f380c13b | Critical | 100/100 | Payload | Mirai | Associated with elf.mirai activity; source classification: payload. |
| d3fa2dc23f90c19b36828887b0f70b1e1477a3e5229d7ca8b4ef38c6d609f90d | Critical | 100/100 | Payload | Mirai | Associated with elf.mirai activity; source classification: payload. |
| 39199d6c565b890e2ebd89a9c0166d931a64cad70080581626856e58f3f48fce | Critical | 100/100 | Payload | Mirai | Associated with elf.mirai activity; source classification: payload. |
| 0c4bfa96b30bf3046a70d8a0143ed419a7cd58b55091c85da619a8a22cd31e1b | Critical | 100/100 | Payload | Mirai | Associated with elf.mirai activity; source classification: payload. |
| 7f60f81bf16d3d1ab05fee87e9f299a96f46771917f5ae755231b9242e21fd72 | Critical | 90/100 | Payload | AMOS | Associated with osx.amos activity; source classification: payload. |
| 142[.]93[.]6[.]168:8443 | Critical | 100/100 | Botnet / C2 | Aisuru | Associated with elf.aisuru activity; source classification: botnet_cc. |
| 104[.]234[.]94[.]197:1244 | Critical | 100/100 | Botnet / C2 | BeaverTail | Associated with js.beavertail activity; source classification: botnet_cc. |
| 104[.]234[.]94[.]197:2225 | Critical | 100/100 | Botnet / C2 | BeaverTail | Associated with js.beavertail activity; source classification: botnet_cc. |
| 107[.]182[.]130[.]29:2250 | Critical | 100/100 | Botnet / C2 | OtterCookie | Associated with js.otter_cookie activity; source classification: botnet_cc. |
| 138[.]201[.]124[.]236:1274 | Critical | 100/100 | Botnet / C2 | BeaverTail | Associated with js.beavertail activity; source classification: botnet_cc. |
| hxxp://104[.]234[.]94[.]197:1244/main | Critical | 100/100 | Payload Delivery | BeaverTail | Associated with js.beavertail activity; source classification: payload_delivery. |
| hxxp://104[.]234[.]94[.]197:1244/client/36/346 | Critical | 100/100 | Payload Delivery | BeaverTail | Associated with js.beavertail activity; source classification: payload_delivery. |
| hxxp://104[.]234[.]94[.]197:1244/ncli/36/346 | Critical | 100/100 | Payload Delivery | BeaverTail | Associated with js.beavertail activity; source classification: payload_delivery. |
| hxxp://104[.]234[.]94[.]197:1244/payload/36/346 | Critical | 100/100 | Payload Delivery | BeaverTail | Associated with js.beavertail activity; source classification: payload_delivery. |
Source: User-provided IOC feed export dated 1 October 2026. The supplied feed identifies the displayed values as source-provided confidence; IOCs are defanged for safe publication.