CYBERRAKSHAK LABS · DAILY GLOBAL THREAT INTELLIGENCE
GTI Feed — 3 October 2026
Daily defensive threat intelligence feed containing 100 source-provided, defanged indicators for 3 October 2026.
Table format: IoC · Severity · Confidence · Involved Threat Type · Malware / Family · Brief Attack Description
| IoC | Severity | Confidence | Involved Threat Type | Malware / Family | Brief Attack Description |
|---|---|---|---|---|---|
| 00rr59n2[.]en-pegasus[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 00vn1[.]top | critical | 100/100 | domain | unknown_rat | Associated with botnet_cc activity; source classification: domain. |
| 01h0oh62[.]www-glycofree[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 0225958080[.]com | critical | 100/100 | domain | unknown_loader | Associated with payload_delivery activity; source classification: domain. |
| 02eiya9o[.]xn--ndux-kza[.]store | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 03wvqe2b[.]go-flashburn[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 044shs8u[.]tapkita[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 07827[.]icu | critical | 100/100 | domain | js.iclickfix | Associated with botnet_cc activity; source classification: domain. |
| 086bn6e3[.]prostafene[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 095b8b1d[.]imzural[.]info | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 09pl09jo[.]dokturumsensin[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 09xadksl[.]wismajoko[.]net | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 0doro4y0[.]www-genesisrevival[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 0fbw5tqk[.]imzural[.]info | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 0gnu5zak[.]edebiyatkonulari[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 0hb2vcul[.]xen-burn[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 0hd4saaw[.]bossizmit[.]store | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 0ijvvr6j[.]en-en--cardioslim[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 0j03b8ri[.]jetbahis2023[.]xyz | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 0ki6ewis[.]wiskaoane[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 0n1d6w64[.]wignalllindor[.]wiki | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 0nmf90it[.]sallysprattstudio[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 0r7u0-admiral-x[.]icu | critical | 100/100 | domain | js.iclickfix | Associated with botnet_cc activity; source classification: domain. |
| 0rqzexak[.]binazirvarzesh[.]ir | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 0vrtpzj3[.]us-en-us-darkreset[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 0wtobgd6[.]venoplus[.]us | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 0ygn6edx[.]exploringvirtualreality[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1089813[.]us31[.]myftpupload[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 110digitech[.]com[.]au | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 111tv[.]it | critical | 100/100 | domain | js.iclickfix | Associated with payload_delivery activity; source classification: domain. |
| 120hotelboutique[.]com[.]br | critical | 100/100 | domain | unknown_loader | Associated with payload_delivery activity; source classification: domain. |
| 123b[.]pictures | critical | 100/100 | domain | win.remcos | Associated with botnet_cc activity; source classification: domain. |
| 123bcasino[.]us | critical | 100/100 | domain | win.remcos | Associated with botnet_cc activity; source classification: domain. |
| 12cscmg1[.]enus-tupitea[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 12jzlr7i[.]boano[.]store | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 13win5y[.]com | critical | 100/100 | domain | js.iclickfix | Associated with payload_delivery activity; source classification: domain. |
| 14fet9qp[.]hwgrouppik[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 15fc73d7[.]wignalllindor[.]wiki | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 15marches[.]fr | critical | 100/100 | domain | unknown_rat | Associated with payload_delivery activity; source classification: domain. |
| 16dewaslot[.]org | critical | 100/100 | domain | win.vidar | Associated with botnet_cc activity; source classification: domain. |
| 16mconseil[.]fr | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 16mp59qr[.]usen-neurovera[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 172u1sfd[.]diero[.]store | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 17575bbb[.]roseanne[.]id | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 17p9jll6[.]1xborobetyek[.]bet | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 17pqcbl3[.]mychartradyschildrens[.]org | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1873[.]co[.]jp | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 188toto[.]co | critical | 100/100 | domain | win.remcos | Associated with botnet_cc activity; source classification: domain. |
| 18ttucts[.]us-en-us-eloncode[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1913financial[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 19kiojm6[.]us-thetrumptoken[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1a3qsz5i[.]pozitifmed[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1business[.]org | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1cfx1w5z[.]zen-sulin[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1cujg0ph[.]nomoneynohoney[.]org | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1dpxqjxq[.]larize[.]store | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1f168[.]com | critical | 100/100 | domain | win.remcos | Associated with botnet_cc activity; source classification: domain. |
| 1g5uv0u1[.]wisma138eula[.]org | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1hko[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1khihj5o[.]bizne[.]store | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1mataw10[.]moltem[.]store | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1profitdeal[.]com | critical | 100/100 | domain | unknown_stealer | Associated with payload_delivery activity; source classification: domain. |
| 1rlnt3t6[.]kiper[.]store | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1slpcrcm[.]risk[.]com[.]sg | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1stchoicecleaning[.]co[.]nz | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1stchoicestaffing[.]co[.]uk | critical | 100/100 | domain | js.iclickfix | Associated with payload_delivery activity; source classification: domain. |
| 1szmvih8[.]www-cardioslim[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1tmo4621[.]succeswithpaul[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1trvapwl[.]usen-neurovera[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1uysxtcp[.]bizne[.]store | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1warbe[.]life | critical | 100/100 | domain | js.iclickfix | Associated with botnet_cc activity; source classification: domain. |
| 1wfeel[.]life | critical | 100/100 | domain | js.iclickfix | Associated with botnet_cc activity; source classification: domain. |
| 1whaiv[.]life | critical | 100/100 | domain | js.iclickfix | Associated with botnet_cc activity; source classification: domain. |
| 1wjwpo[.]life | critical | 100/100 | domain | js.iclickfix | Associated with botnet_cc activity; source classification: domain. |
| 1wtugs[.]life | critical | 100/100 | domain | js.iclickfix | Associated with botnet_cc activity; source classification: domain. |
| 1wubqv[.]life | critical | 100/100 | domain | js.iclickfix | Associated with botnet_cc activity; source classification: domain. |
| 1xbitios[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 1yyhju9i[.]noug[.]store | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 21-realty[.]com | critical | 100/100 | domain | js.iclickfix | Associated with payload_delivery activity; source classification: domain. |
| 23568fdq[.]mosbatsms[.]ir | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 23win[.]net[.]im | critical | 100/100 | domain | win.remcos | Associated with botnet_cc activity; source classification: domain. |
| 247wholesale[.]co[.]uk | critical | 100/100 | domain | js.iclickfix | Associated with payload_delivery activity; source classification: domain. |
| 248labs[.]ch | critical | 100/100 | domain | unknown | Associated with payload_delivery activity; source classification: domain. |
| 24emergencyelectricalservices[.]co[.]uk | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 24telectrical[.]co[.]uk | critical | 100/100 | domain | unknown_rat | Associated with payload_delivery activity; source classification: domain. |
| 24ucaqa7[.]enobahiss[.]xyz | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 24x7remediation[.]com | critical | 100/100 | domain | js.iclickfix | Associated with payload_delivery activity; source classification: domain. |
| 254045mx[.]xenburn[.]us | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 26a0ed72[.]finowfurt[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 26television[.]com | critical | 100/100 | domain | unknown_loader | Associated with payload_delivery activity; source classification: domain. |
| 2a2m8vsh[.]www-trumpgoldenbadge[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 2ah1xj15[.]bet-303[.]fun | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 2bike[.]cn | critical | 100/100 | domain | js.iclickfix | Associated with payload_delivery activity; source classification: domain. |
| 2brosnme[.]com | critical | 100/100 | domain | js.iclickfix | Associated with payload_delivery activity; source classification: domain. |
| 2dm5zbbk[.]oris303[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 2epf8wxl[.]josephmichaelnh[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 2gf[.]it | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 2gp421dm[.]en-us-en-smartwaterbox[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 2il2x7ac[.]artenadigital[.]com | critical | 100/100 | domain | js.clearfake | Associated with payload_delivery activity; source classification: domain. |
| 2mdinfissi[.]it | critical | 100/100 | domain | js.iclickfix | Associated with payload_delivery activity; source classification: domain. |
Source: User-provided IOC feed export dated 1 October 2026. The supplied feed identifies the displayed values as source-provided confidence; IOCs are defanged for safe publication.