CYBERRAKSHAK LABS · DAILY GLOBAL THREAT INTELLIGENCE
GTI Feed — 9 October 2026
Daily defensive threat intelligence feed containing 100 source-provided, defanged indicators for 9 October 2026.
Table format: IoC · Severity · Confidence · Involved Threat Type · Malware / Family · Brief Attack Description
| IoC | Severity | Confidence | Involved Threat Type | Malware / Family | Brief Attack Description |
|---|---|---|---|---|---|
nr[.]3toto[.]com | CRITICAL | 100/100 | botnet_cc | win.vidar | Associated with win.vidar activity; source classification: botnet_cc. |
nr[.]333vip[.]org | CRITICAL | 100/100 | botnet_cc | win.vidar | Associated with win.vidar activity; source classification: botnet_cc. |
helianthus[.]ch | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
ehvrou8y[.]sarmo[.]store | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
bbuxtc93[.]osan[.]store | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
livto[.]store | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
lezo[.]store | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
mahoomahtab[.]ir | CRITICAL | 90/100 | payload_delivery | unknown | Associated with unknown activity; source classification: payload_delivery. |
verifiedbmsells[.]com | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
wealthywealth[.]co[.]za | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
www[.]heritagemusical[.]com | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
www[.]smartlivingstyle[.]cat | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
fernandeseneri[.]adv[.]br | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
industriafortefibra[.]com[.]br | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
narowalgymkhana[.]com | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
productpalace[.]pk | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
tesafco[.]ir | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
austin-zhao[.]com | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
clickfix[.]jordiserrano[.]me | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
ik[.]3toto[.]com | CRITICAL | 100/100 | botnet_cc | win.vidar | Associated with win.vidar activity; source classification: botnet_cc. |
oi41pfmg[.]saok[.]store | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
ik[.]333vip[.]org | CRITICAL | 100/100 | botnet_cc | win.vidar | Associated with win.vidar activity; source classification: botnet_cc. |
9x1od7j1[.]musux[.]store | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
script-six-tawny[.]vercel[.]app | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
lasal[.]store | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
fri-dod-01[.]cfd | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
demogortexpro[.]cc | CRITICAL | 90/100 | payload_delivery | unknown | Associated with unknown activity; source classification: payload_delivery. |
lacek[.]store | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
keca[.]store | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
coppertrack[.]cfd | CRITICAL | 100/100 | botnet_cc | unknown_loader | Associated with unknown_loader activity; source classification: botnet_cc. |
fluszoif[.]sulaf[.]store | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
main-salesforce[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]usa-salesforce[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
fast-api[.]thelist2win[.]org | CRITICAL | 100/100 | botnet_cc | js.fakeupdates | Associated with js.fakeupdates activity; source classification: botnet_cc. |
haergreve[.]lol | CRITICAL | 100/100 | payload_delivery | js.kongtuke | Associated with js.kongtuke activity; source classification: payload_delivery. |
ss[.]3toto[.]com | CRITICAL | 100/100 | botnet_cc | win.vidar | Associated with win.vidar activity; source classification: botnet_cc. |
xveuttyd[.]murup[.]store | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
w5tv1jh1[.]salgu[.]store | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
hollowand[.]com | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
www[.]umzug-laubach[.]de | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
kalem[.]store | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
ss[.]333vip[.]org | CRITICAL | 100/100 | botnet_cc | win.vidar | Associated with win.vidar activity; source classification: botnet_cc. |
7xlu446x[.]subar[.]store | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
vmi3641492[.]contaboserver[.]net | CRITICAL | 100/100 | payload_delivery | unknown | Associated with unknown activity; source classification: payload_delivery. |
alphamap[.]net | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
rebrato[.]com | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
gsdfguhjsdfgdfjg[.]xyz | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
seconurl[.]com | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
xorados[.]com | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
e3k00lxe[.]truenarrator[.]com | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
mgxyuko[.]xyz | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
vmi3641491[.]contaboserver[.]net | CRITICAL | 100/100 | payload_delivery | unknown | Associated with unknown activity; source classification: payload_delivery. |
dkoretar[.]noip[.]at | CRITICAL | 100/100 | botnet_cc | unknown | Associated with unknown activity; source classification: botnet_cc. |
midtown[.]ilovecollege[.]info | CRITICAL | 100/100 | botnet_cc | unknown | Associated with unknown activity; source classification: botnet_cc. |
renotad[.]com | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
cosmical2049[.]com | CRITICAL | 100/100 | payload_delivery | js.iclickfix | Associated with js.iclickfix activity; source classification: payload_delivery. |
lavendertome[.]co | CRITICAL | 100/100 | payload_delivery | js.smartapesg | Associated with js.smartapesg activity; source classification: payload_delivery. |
api[.]kookjar[.]com | CRITICAL | 100/100 | botnet_cc | apk.badbox | Associated with apk.badbox activity; source classification: botnet_cc. |
www[.]mcdanielwoolf[.]co[.]uk | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
content[.]dlcore[.]cc | CRITICAL | 100/100 | botnet_cc | win.acr_stealer | Associated with win.acr_stealer activity; source classification: botnet_cc. |
www[.]oniramen[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]nyankids[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]sonquimet[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]riverviewpharmacynj[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]milleniummortgage[.]net | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
ukagir[.]ru | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]verbum[.]cz | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
juniorjoias[.]com[.]br | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]platino[.]com[.]mx | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
gorsefield[.]cc | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]toutvabienbien[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]n-sommer[.]de | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]rkpelet[.]sk | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]mariusbroeders[.]nl | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]espacesante-suisse[.]ch | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
dr-sorayatavakoli[.]ir | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
1c6pukow[.]sadis[.]store | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
0to3v0ri[.]morib[.]store | CRITICAL | 100/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]aibestuse[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]fulltimeservices[.]com[.]br | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
namet[.]com[.]au | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
europevoyages-madagascartours[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
iaro[.]org[.]nz | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
behinja[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
kanasacademy[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]fasthomepath[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
arnidecor[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]bindslev-museum[.]dk | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
bulimester[.]hu | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
chogianphoi[.]vn | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
drmitachowdhury[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]jk-products[.]co[.]za | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
comprojoiasrj[.]com[.]br | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
bollnasbilatervinning[.]se | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]hartransplantasjon[.]eu | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
www[.]e-bikroy[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
intercobrancas[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
cortimet[.]cl | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
baferequipos[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
davidov-property[.]com | CRITICAL | 90/100 | payload_delivery | js.clearfake | Associated with js.clearfake activity; source classification: payload_delivery. |
Source: User-provided IOC feed export dated 26 September 2026. The supplied feed identifies the 100 values as source-provided confidence; IOCs are defanged for safe publication.