Vivek Kumar, Lead Cybersecurity ConsultantVIVEK KUMAR
WAinYTIG𝕏f
CYBERRAKSHAK LABS · DAILY GLOBAL THREAT INTELLIGENCE

GTI Feed — 15 October 2026

Daily defensive threat intelligence feed containing 100 source-provided, defanged indicators for 15 October 2026.

Table format: IoC · Severity · Confidence · Involved Threat Type · Malware / Family · Brief Attack Description
IoCSeverityConfidenceInvolved Threat TypeMalware / FamilyBrief Attack Description
accounts-google-check[.]netlify[.]appCRITICAL90/100payload_delivery—Source classification is unknown in the supplied feed.
w8cyew46[.]metricsdataapi[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
sam-tech[.]proCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
amanahtotonice[.]de[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
fplsoznh[.]brian-mcdermott[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
amanahtotomobile[.]de[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
patratrimulia[.]comCRITICAL90/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
biggerworldclassstandard[.]comCRITICAL100/100botnet_ccCloudEyeAssociated with CloudEye activity according to the source classification.
commonhedgehogs[.]comCRITICAL100/100botnet_ccCloudEyeAssociated with CloudEye activity according to the source classification.
news[.]pieset[.]coCRITICAL100/100payload_deliverySmartApeSGAssociated with SmartApeSG activity according to the source classification.
ir[.]hg77[.]orgCRITICAL100/100payload_deliveryVidarAssociated with Vidar activity according to the source classification.
z0wbdk[.]5tr[.]orgCRITICAL100/100payload_deliveryVidarAssociated with Vidar activity according to the source classification.
csgroup[.]hostCRITICAL100/100payload_deliveryUnknown StealerThe source associates this indicator with unknown stealer activity; an exact family is not identified.
therapygeorgia[.]comCRITICAL100/100payload_deliveryMacSyncAssociated with MacSync activity according to the source classification.
armwrestlers[.]clubCRITICAL100/100botnet_ccWarden StealerAssociated with Warden Stealer activity according to the source classification.
catloverzz[.]clubCRITICAL100/100botnet_ccWarden StealerAssociated with Warden Stealer activity according to the source classification.
medicialanswers[.]forumCRITICAL100/100botnet_ccWarden StealerAssociated with Warden Stealer activity according to the source classification.
medicinevacansies[.]workCRITICAL100/100botnet_ccWarden StealerAssociated with Warden Stealer activity according to the source classification.
st-attr[.]robstuder[.]orgCRITICAL100/100botnet_ccFakeUpdatesAssociated with FakeUpdates activity according to the source classification.
6stmmehy[.]mdaasesorias[.]com[.]mxCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
trywebdesign[.]comCRITICAL90/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
amanahtotolust[.]us[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
amanahtotolive[.]de[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
nuv6c5c1[.]biolinkit[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
www[.]mgttw[.]comCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
tjsmedical[.]comCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
jrr[.]77tuna[.]orgCRITICAL100/100botnet_ccVidarAssociated with Vidar activity according to the source classification.
covalenthomes[.]comCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
amanahtotolite[.]de[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
r82uywn7[.]mbaconsultingus[.]netCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
ny6047lj[.]beterbewegenmetyael[.]blogCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
amanahtotokeren[.]uk[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
rc0[.]flavorroute[.]ccCRITICAL90/100payload_delivery—Source classification is unknown in the supplied feed.
tarrantcountyaccidentandinjuryattorneys[.]comCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
www[.]fracino[.]clCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
www[.]arkgrup[.]comCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
www[.]4jumps[.]itCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
www[.]sbmalley[.]comCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
www[.]janubhavtaxsolutions[.]comCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
amanahtotoind[.]de[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
kozgroup[.]caCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
www[.]phoenixaluminium[.]ieCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
5iwj5wcz[.]iscc[.]com[.]mxCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
jaassen[.]lolCRITICAL100/100payload_deliveryKongtukeAssociated with Kongtuke activity according to the source classification.
axulus[.]ioCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
nothingnew[.]wpengine[.]comCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
phs72t70[.]citasasesor[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
tenniskurs-zollikon[.]chCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
amanahtotoid[.]us[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
blog[.]donitesmithy[.]infoCRITICAL100/100payload_deliverySmartApeSGAssociated with SmartApeSG activity according to the source classification.
wuntred[.]comCRITICAL100/100botnet_ccUnknown LoaderThe source associates this indicator with unknown loader activity; an exact family is not identified.
ip-vm[.]vercel[.]appCRITICAL100/100payload_deliveryContagious DropAssociated with Contagious Drop activity according to the source classification.
kx4z8st8[.]escritoriovirtualasesor[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
amanahtotoceria[.]us[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
liavruizskioo[.]proCRITICAL100/100payload_deliveryClickFixAssociated with ClickFix activity according to the source classification.
brisk-sail-ridge-dreor[.]proCRITICAL100/100payload_deliveryClickFixAssociated with ClickFix activity according to the source classification.
7z8lxhnj[.]citaasesoriareyes[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
franken-consulting[.]orgCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
amanahtop[.]us[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
www[.]virealestate[.]comCRITICAL90/100payload_deliveryUnspecifiedSource identifies this indicator as compromised infrastructure used for payload delivery; no specific malware family is identified in the supplied row.
year[.]calvinpreschooloffice[.]comCRITICAL100/100botnet_ccClearFakeAssociated with ClearFake activity according to the source classification.
year[.]calvinpreschooloffice[.]comCRITICAL100/100payload_deliveryClickFixAssociated with ClickFix activity according to the source classification.
kmxvvkoq[.]enlineaempresarial[.]com[.]mxCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
amanahsukses[.]uk[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
thjduywf[.]asociadospacifico[.]comCRITICAL100/100payload_deliveryClearFakeAssociated with ClearFake activity according to the source classification.
www[.]4qvjsgir09s5j8saytt0jds[.]netCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]bl32hm8oxzy3yome193[.]ccCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]d6mb39632ubz4kas62v[.]netCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]0jy0f773x1e08b68h[.]netCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]mvgl1ne40s65srdtnlc[.]infoCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]efziqo9lqgsakqmvf[.]ccCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]h4sowoxr64rsj5-cpsuhd[.]ccCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]nipreaznltdoof10dsb-so[.]appCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]18sf1ka7leb3sllhlhv[.]liveCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]97faid0d4bmpph3wrxhv[.]orgCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]wtfdofnoku2s4gn61ub[.]infoCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]8qbwoyoeugilmbpiyjx-2cm[.]netCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]vbix6zw2k7b1tsccegyt4eyn[.]liveCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]i9ouovd08z68oi4jluf-z[.]comCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]983htq324matt9ga5[.]ccCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]72twifi6o1x7zs4jag[.]netCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]4bivqxzwjh8bpoge585[.]netCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]9u-wediplo9i-ry1gc1k[.]infoCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]rg82z9wtgt9b-m61p[.]ccCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]f5u-uhpdrtwj6azysqpud[.]netCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]gbgzdxue8l3ajj7syni[.]infoCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]i1m7mt66vo69eakuu74e[.]ccCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]osh9xntw0spl96bbe[.]orgCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]373hf1zy01njyqbz[.]liveCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]z40xmimvhbytcnppy1rs3[.]appCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]zrs7b8boubf9y-b1[.]netCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]canaza7epbbtducao-ve0s[.]ccCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]f9p0blhu2vw6rkwo[.]comCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]a0zajmpz4610-sdfbt[.]ccCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]knrd2up67onim5epfcxgvx[.]netCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]774a126sz-yyipum1tvcvltl[.]appCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]8lxnx9b3q-dqubl0ca3h[.]comCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]7bh-wy20nkoehf3adcj4kge[.]netCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]2d2eb-7dzk-akmg1jovs[.]netCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.
www[.]aj-vxvadzcbs26gxz[.]orgCRITICAL90/100botnet_ccCorunaAssociated with Coruna activity according to the source classification.

Source: User-provided IOC feed export dated 15 October 2026. Confidence values are source-provided, not independently calculated by CyberRakshakLabs; IOCs are defanged for safe publication. Malware/family labels are normalized from source activity names and are not independently validated. First-seen timestamps are preserved in historical data but omitted from this table by design.

← Live GTI FeedGTI Archive →