CYBERRAKSHAK LABS · DAILY GLOBAL THREAT INTELLIGENCE

GTI Feed — 13 October 2026

Name: CyberRakshakLabs Daily Threat Intelligence Feed — 13 October 2026
Creator: CyberRakshakLabs
Published: 2026-10-13

Daily defensive threat intelligence feed containing 100 source-provided, defanged indicators for 13 October 2026.

Table format: IoC · Severity · Confidence · Involved Threat Type · Malware / Family · Brief Attack Description

IoC	Severity	Confidence	Involved Threat Type	Malware / Family	Brief Attack Description
`rtplive-miliarbet[.]online`	CRITICAL	100/100	payload_delivery	ClearFake	Associated with ClearFake activity according to the source classification.
`09f9wqsm[.]kaarenorge[.]com`	CRITICAL	100/100	payload_delivery	ClearFake	Associated with ClearFake activity according to the source classification.
`www[.]gtw[.]kiwi[.]nz`	CRITICAL	90/100	payload_delivery	Unspecified	The source identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
`b[.]666iapk[.]net`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`thefoodsauciety[.]co[.]uk`	CRITICAL	90/100	payload_delivery	Unspecified	The source identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
`8f900d33[.]paketmalam[.]vip`	CRITICAL	90/100	payload_delivery	ClearFake	Associated with ClearFake activity according to the source classification.
`1ywz60u1[.]cicakdidinding[.]org`	CRITICAL	100/100	payload_delivery	ClearFake	Associated with ClearFake activity according to the source classification.
`paketmalam[.]vip`	CRITICAL	100/100	payload_delivery	ClearFake	Associated with ClearFake activity according to the source classification.
`xzttyt[.]xyz`	CRITICAL	90/100	payload_delivery	ClearFake	Associated with ClearFake activity according to the source classification.
`www[.]jollyparcheggio[.]it`	CRITICAL	90/100	payload_delivery	Unspecified	The source identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
`systemnotifier[.]st`	CRITICAL	90/100	payload_delivery	Unspecified	The supplied feed does not identify a specific malware family; source classification is unknown for this payload_delivery indicator.
`bra[.]666iapk[.]net`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`lunza[.]store`	CRITICAL	100/100	payload_delivery	ClearFake	Associated with ClearFake activity according to the source classification.
`jui[.]666iapk[.]net`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`kodigi[.]in`	CRITICAL	90/100	payload_delivery	Unspecified	The source identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
`www[.]guidaratatouille[.]com`	CRITICAL	90/100	payload_delivery	Unspecified	The source identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
`madenova[.]com[.]br`	CRITICAL	90/100	payload_delivery	Unspecified	The source identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
`runelite[.]is`	CRITICAL	100/100	botnet_cc	Unspecified	The supplied feed does not identify a specific malware family; source classification is unknown for this botnet_cc indicator.
`client-runelite[.]is`	CRITICAL	100/100	botnet_cc	Unspecified	The supplied feed does not identify a specific malware family; source classification is unknown for this botnet_cc indicator.
`runelite[.]menu`	CRITICAL	100/100	payload_delivery	Unspecified	The supplied feed does not identify a specific malware family; source classification is unknown for this payload_delivery indicator.
`reed-koaor-tekzr[.]pro`	CRITICAL	100/100	payload_delivery	ClickFix	Associated with ClickFix activity according to the source classification.
`seo[.]codesmithsystems[.]com`	CRITICAL	100/100	payload_delivery	ClickFix	Associated with ClickFix activity according to the source classification.
`grove-fiis-y7ua8[.]pro`	CRITICAL	100/100	payload_delivery	ClickFix	Associated with ClickFix activity according to the source classification.
`northhouse[.]cfd`	CRITICAL	100/100	botnet_cc	Unknown Loader	The source classifies this indicator as unknown loader activity.
`www[.]webmavennj[.]com`	CRITICAL	90/100	payload_delivery	Unspecified	The source identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
`tools[.]studerandson[.]com`	CRITICAL	100/100	botnet_cc	FakeUpdates	Associated with FakeUpdates activity according to the source classification.
`www[.]mybkexperience[.]onl`	CRITICAL	90/100	payload_delivery	Unspecified	The source identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
`get[.]666iapk[.]net`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`29t3qs74[.]chloesteph[.]com`	CRITICAL	100/100	payload_delivery	ClearFake	Associated with ClearFake activity according to the source classification.
`foi[.]666iapk[.]net`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`des[.]666iapk[.]net`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`bob[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`x3a[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`32cb0fe5[.]roseanne[.]id`	CRITICAL	90/100	payload_delivery	ClearFake	Associated with ClearFake activity according to the source classification.
`palm[.]blueridgekcmo[.]com`	CRITICAL	100/100	botnet_cc	ClearFake	Associated with ClearFake activity according to the source classification.
`nyr[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`palm[.]blueridgekcmo[.]com`	CRITICAL	100/100	payload_delivery	ClickFix	Associated with ClickFix activity according to the source classification.
`ochuss[.]es`	CRITICAL	90/100	payload_delivery	Unspecified	The source identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
`q6[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`zpz[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`raft[.]asyoulike[.]nyc`	CRITICAL	90/100	botnet_cc	Telepuz	Associated with Telepuz activity according to the source classification.
`clay[.]asianpalaceii[.]com`	CRITICAL	90/100	botnet_cc	Telepuz	Associated with Telepuz activity according to the source classification.
`frog[.]britishboxing[.]net`	CRITICAL	90/100	botnet_cc	Telepuz	Associated with Telepuz activity according to the source classification.
`msm[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`lp[.]imersaosevenx[.]com[.]br`	CRITICAL	90/100	payload_delivery	Unspecified	The source identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
`robinsoo[.]lol`	CRITICAL	100/100	payload_delivery	KongTuke	Associated with KongTuke activity according to the source classification.
`lra[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`mgs[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`browse-veriid[.]beer`	CRITICAL	100/100	payload_delivery	ClickFix	Associated with ClickFix activity according to the source classification.
`dp1[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`nnf[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`n34[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`b6y[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`mikoblico[.]xyz`	CRITICAL	100/100	botnet_cc	Unspecified	The supplied feed does not identify a specific malware family; source classification is unknown for this botnet_cc indicator.
`profile[.]turquoisequadrant[.]info`	CRITICAL	100/100	payload_delivery	SmartApeSG	Associated with SmartApeSG activity according to the source classification.
`sik[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`mke[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`sonido13[.]com`	CRITICAL	90/100	payload_delivery	Unspecified	The source identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
`brightbunnyservices[.]com`	CRITICAL	90/100	payload_delivery	Unspecified	The source identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
`digitalleads[.]shop`	CRITICAL	90/100	payload_delivery	Unspecified	The source identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
`butlerskateland[.]com`	CRITICAL	90/100	payload_delivery	Unspecified	The source identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
`vty[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`efq[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`ingestwebneo[.]com`	CRITICAL	100/100	payload_delivery	ClickFix	Associated with ClickFix activity according to the source classification.
`heartbeatyardpoint[.]com`	CRITICAL	100/100	payload_delivery	ClickFix	Associated with ClickFix activity according to the source classification.
`bty[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`mgu[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`bduwih8[.]pro`	CRITICAL	100/100	payload_delivery	ClickFix	Associated with ClickFix activity according to the source classification.
`citcix6[.]xyz`	CRITICAL	100/100	payload_delivery	ClickFix	Associated with ClickFix activity according to the source classification.
`gesck4m[.]pro`	CRITICAL	100/100	payload_delivery	ClickFix	Associated with ClickFix activity according to the source classification.
`hf98x4d[.]site`	CRITICAL	100/100	payload_delivery	ClickFix	Associated with ClickFix activity according to the source classification.
`sj98xe4[.]xyz`	CRITICAL	100/100	payload_delivery	ClickFix	Associated with ClickFix activity according to the source classification.
`smdh7[.]surf`	CRITICAL	100/100	payload_delivery	ClickFix	Associated with ClickFix activity according to the source classification.
`fif[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`vtr[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`xsl[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`hsk19cqn[.]kaarenorge[.]com`	CRITICAL	100/100	payload_delivery	ClearFake	Associated with ClearFake activity according to the source classification.
`fqa[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`startrekfleetcommand[.]com`	CRITICAL	100/100	payload_delivery	ClickFix	Associated with ClickFix activity according to the source classification.
`mim[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`bru[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`internetlouisiana[.]com`	CRITICAL	100/100	payload_delivery	MacSync	Associated with MacSync activity according to the source classification.
`gki[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`owo[.]efunmilowoonline[.]top`	CRITICAL	100/100	botnet_cc	Unknown RAT	The source classifies this indicator as unknown RAT activity.
`efunmilowoonline[.]top`	CRITICAL	100/100	botnet_cc	Unknown RAT	The source classifies this indicator as unknown RAT activity.
`bok[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`teknnovationbyobaid[.]teknnovation[.]com`	CRITICAL	90/100	payload_delivery	Unspecified	The source identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
`iy5iikmqxercpdjk5swzib2m2f3sn6o3o7khivgul4f47nweflusqiqd[.]onion`	CRITICAL	100/100	botnet_cc	Unspecified	The supplied feed does not identify a specific malware family; source classification is unknown for this botnet_cc indicator.
`4vr5sxshsx6se4qixnrvbqyikqtknfjhe4ybitp2zhjjzazm4ohawbid[.]onion`	CRITICAL	100/100	botnet_cc	Unspecified	The supplied feed does not identify a specific malware family; source classification is unknown for this botnet_cc indicator.
`kik[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`data[.]vaceditions[.]com`	CRITICAL	100/100	payload_delivery	Unknown RAT	The source classifies this indicator as unknown RAT activity.
`my-adobe-plugins-update[.]top`	CRITICAL	100/100	payload_delivery	Unknown RAT	The source classifies this indicator as unknown RAT activity.
`acrob[.]my-adobe-plugins-update[.]top`	CRITICAL	100/100	payload_delivery	Unknown RAT	The source classifies this indicator as unknown RAT activity.
`moh[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.
`fe29jf323[.]kesug[.]com`	CRITICAL	90/100	botnet_cc	Konni	Associated with Konni activity according to the source classification.
`inini[.]kesug[.]com`	CRITICAL	90/100	botnet_cc	Kimsuky	Associated with Kimsuky activity according to the source classification.
`wall[.]casajuanchos[.]com`	CRITICAL	90/100	payload_delivery	Unspecified	The supplied feed does not identify a specific malware family; source classification is unknown for this payload_delivery indicator.
`bee[.]beachcafemb[.]com`	CRITICAL	90/100	botnet_cc	Telepuz	Associated with Telepuz activity according to the source classification.
`lebang[.]si`	CRITICAL	100/100	payload_delivery	PeaceNotWar	Associated with PeaceNotWar activity according to the source classification.
`rrj[.]6666k[.]org`	CRITICAL	100/100	botnet_cc	Vidar	Associated with Vidar activity according to the source classification.

Source: User-provided IOC feed export dated 13 October 2026. Confidence values are source-provided, not independently calculated by CyberRakshakLabs; IOCs are defanged for safe publication. Malware/family labels are normalized from source activity names and are not independently validated. First-seen timestamps are preserved in historical data but omitted from this table by design.

← Live GTI Feed GTI Archive →