CYBERRAKSHAK LABS · DAILY GLOBAL THREAT INTELLIGENCE
GTI Feed — 20 October 2026
Daily defensive threat intelligence feed containing 100 source-provided, defanged indicators for 20 October 2026.
Table format: IoC · Severity · Confidence · Involved Threat Type · Malware / Family · Brief Attack Description
| IoC | Severity | Confidence | Involved Threat Type | Malware / Family | Brief Attack Description |
|---|---|---|---|---|---|
| flamingo3dstudio[.]com | critical | 90/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| se7ahj6q[.]laparnih[.]com | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| zif7jqzm[.]bocillanang[.]com | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| 55l9bouy[.]bociljepe[.]info | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| fe5[.]88kfc[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| m[.]9qoi[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| 2ngqe27a[.]bociljp[.]site | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| rl2tx309[.]laborpost[.]com | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| kuo4g8zc[.]bociljepe[.]cc | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| c4ut95w4[.]bociljp[.]online | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| fruit-overall[.]com | critical | 90/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| decoyanswer[.]com | critical | 90/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| egg-crusade[.]com | critical | 90/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| o[.]9qoi[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| jm[.]88kfc[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| y4[.]8g8g[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| 5e5am0xh[.]lanternglow[.]cc | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| lanternglow[.]cc | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| honeytrail[.]cc | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| kihcaneu[.]kakekmain[.]com | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| zipoj1hh[.]blinkhorizon[.]com | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| mf[.]9qoi[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| qmyxmc8z[.]activeloop[.]cc | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| sn[.]88idr[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| l[.]88qr[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| activeloop[.]cc | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| imaweirdo[.]my | critical | 100/100 | botnet_cc | — | The supplied feed records the source classification as unknown; no specific malware family is stated. |
| paranoidjuice[.]info | critical | 100/100 | botnet_cc | — | The supplied feed records the source classification as unknown; no specific malware family is stated. |
| smithsonn-s[.]top | critical | 100/100 | botnet_cc | — | The supplied feed records the source classification as unknown; no specific malware family is stated. |
| howtodisappearcompletely[.]zip | critical | 100/100 | botnet_cc | — | The supplied feed records the source classification as unknown; no specific malware family is stated. |
| h[.]9qoi[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| atc5j2vt[.]coletteloire[.]rest | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| anvil-laii-r7tc2[.]pro | critical | 100/100 | payload_delivery | ClickFix | Associated with ClickFix activity according to the source classification. |
| k778a40y[.]berrythebear[.]com | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| audit[.]bitfetch[.]cc | critical | 100/100 | botnet_cc | ACR Stealer | Associated with ACR Stealer activity according to the source classification. |
| zrmbta5x[.]coletteloire[.]rest | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| xvksxinh[.]coletteloire[.]rest | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| l35ypax8[.]dlcore[.]cc | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| check3wdsorobot[.]cc | critical | 100/100 | payload_delivery | ClickFix | Associated with ClickFix activity according to the source classification. |
| zsql3k3u[.]coletteloire[.]rest | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| 0aylp390[.]coletteloire[.]rest | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| jz[.]88idr[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| xl[.]88qr[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| ppilipp[.]lol | critical | 100/100 | payload_delivery | KongTuke | Associated with KongTuke activity according to the source classification. |
| deushack[.]org | critical | 100/100 | payload_delivery | Donut Injector | Associated with Donut Injector activity according to the source classification. |
| caffe-img[.]com | critical | 100/100 | payload_delivery | ClickFix | Associated with ClickFix activity according to the source classification. |
| caffe-store-like[.]beer | critical | 100/100 | payload_delivery | ClickFix | Associated with ClickFix activity according to the source classification. |
| groverudder12[.]com | critical | 100/100 | payload_delivery | AMOS | Associated with AMOS activity according to the source classification. |
| cloud-browse[.]codes | critical | 100/100 | payload_delivery | ClickFix | Associated with ClickFix activity according to the source classification. |
| wifihgu[.]duckdns[.]org | critical | 100/100 | botnet_cc | MooBot | Associated with MooBot activity according to the source classification. |
| ou[.]9kio[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| cdn[.]img[.]76e1e5fa[.]PNAlumni[.]dgitd[.]anchorbolnorth[.]com | critical | 100/100 | botnet_cc | Cobalt Strike | Associated with Cobalt Strike activity according to the source classification. |
| upi[.]log[.]30ca777733df8aa6e4404bd8beadb65c36105e9346e15819152e9ecc4[.]fd746f6f221867dd6d504e00569cc108bbf5c5e0daf7628d26285775[.]86174a0a1dc3dd1625fc62e486572c26425c95ffef342f6dddb5ffe0[.]1b1f3f2edc[.]7605f6[.]pnalumni[.]dgitd[.]anchorbolnorth[.]com | critical | 100/100 | botnet_cc | Cobalt Strike | Associated with Cobalt Strike activity according to the source classification. |
| calciteperistyle[.]info | critical | 100/100 | payload_delivery | SmartApeSG | Associated with SmartApeSG activity according to the source classification. |
| qhqkc41j[.]coletteloire[.]rest | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| coletteloire[.]rest | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| checkgwfwtg465[.]art | critical | 100/100 | payload_delivery | ClickFix | Associated with ClickFix activity according to the source classification. |
| amm-frosty[.]lol | critical | 100/100 | botnet_cc | Unknown Stealer | The source describes unknown-stealer activity; the specific family is not identified. |
| forge-ember[.]pw | critical | 100/100 | botnet_cc | Unknown Stealer | The source describes unknown-stealer activity; the specific family is not identified. |
| huhowabisi[.]net | critical | 100/100 | botnet_cc | Unknown Stealer | The source describes unknown-stealer activity; the specific family is not identified. |
| 0pu7spir[.]bebaskanlah[.]com | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| 1ehymkfr[.]cloudload[.]cc | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| secdarvin2026[.]icu | critical | 90/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| 3a297305[.]clarins-sale2025[.]online | critical | 90/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| bismarckchiropractor[.]com | critical | 100/100 | payload_delivery | MacSync | Associated with MacSync activity according to the source classification. |
| model[.]bytedrop[.]cc | critical | 100/100 | botnet_cc | ACR Stealer | Associated with ACR Stealer activity according to the source classification. |
| spscryspy[.]com | critical | 90/100 | payload_delivery | — | The supplied feed records the source classification as unknown; no specific malware family is stated. |
| cinecluster[.]com | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| 5kpuhypo[.]blinderai[.]com | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| j9jsia3y[.]bociljp[.]info | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| nexus-panel[.]in | critical | 100/100 | botnet_cc | SMS Spy | Associated with SMS Spy activity according to the source classification. |
| ghostx-panel-default-rtdb[.]firebaseio[.]com | critical | 100/100 | botnet_cc | SMS Spy | Associated with SMS Spy activity according to the source classification. |
| ghostx-panel[.]firebasestorage[.]app | critical | 100/100 | botnet_cc | SMS Spy | Associated with SMS Spy activity according to the source classification. |
| myuse-60542-default-rtdb[.]asia-southeast1[.]firebasedatabase[.]app | critical | 100/100 | botnet_cc | SMS Spy | Associated with SMS Spy activity according to the source classification. |
| myuse-60542[.]firebasestorage[.]app | critical | 100/100 | botnet_cc | SMS Spy | Associated with SMS Spy activity according to the source classification. |
| mparivahan[.]hs[.]vc | critical | 100/100 | botnet_cc | SMS Spy | Associated with SMS Spy activity according to the source classification. |
| mparivahan772[.]s[.]gy | critical | 100/100 | payload_delivery | SMS Spy | Associated with SMS Spy activity according to the source classification. |
| nsx1-7f7aa-default-rtdb[.]asia-southeast1[.]firebasedatabase[.]app | critical | 100/100 | botnet_cc | SMS Spy | Associated with SMS Spy activity according to the source classification. |
| nsx1-7f7aa[.]firebasestorage[.]app | critical | 100/100 | botnet_cc | SMS Spy | Associated with SMS Spy activity according to the source classification. |
| mparivahansms-default-rtdb[.]asia-southeast1[.]firebasedatabase[.]app | critical | 100/100 | botnet_cc | SMS Spy | Associated with SMS Spy activity according to the source classification. |
| mparivahansms[.]firebasestorage[.]app | critical | 100/100 | botnet_cc | SMS Spy | Associated with SMS Spy activity according to the source classification. |
| hdfc-bank-8ab58-default-rtdb[.]firebaseio[.]com | critical | 100/100 | botnet_cc | SMS Spy | Associated with SMS Spy activity according to the source classification. |
| hdfc-bank-8ab58[.]firebasestorage[.]app | critical | 100/100 | botnet_cc | SMS Spy | Associated with SMS Spy activity according to the source classification. |
| panel-sms[.]firebasestorage[.]app | critical | 100/100 | botnet_cc | SMS Spy | Associated with SMS Spy activity according to the source classification. |
| andromeda-d389d[.]firebasestorage[.]app | critical | 100/100 | botnet_cc | SMS Spy | Associated with SMS Spy activity according to the source classification. |
| kjhg[.]lol | critical | 100/100 | botnet_cc | Hermes | Associated with Hermes activity according to the source classification. |
| kjhg[.]shop | critical | 100/100 | botnet_cc | Hermes | Associated with Hermes activity according to the source classification. |
| qo[.]88idr[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| wc[.]88qr[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| j[.]9kio[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| chineseadoptee[.]com | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| mfc7lcz8[.]bociljp[.]id | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| j7[.]88idr[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| f[.]88qr[.]org | critical | 100/100 | botnet_cc | Vidar | Associated with Vidar activity according to the source classification. |
| zen-ignore-tree-include[.]xyz | critical | 90/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| zttrych[.]icu | critical | 90/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| a2bfc593[.]cerridwen[.]shop | critical | 90/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| cerridwen[.]shop | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
| leafdraft18[.]com | critical | 100/100 | payload_delivery | AMOS | Associated with AMOS activity according to the source classification. |
| xx5m70m0[.]beyonce[.]id | critical | 100/100 | payload_delivery | ClearFake | Associated with ClearFake activity according to the source classification. |
Source: User-provided IOC feed export dated 20 October 2026. Confidence values (90/100–100/100) are source-provided, not independently calculated; IOCs are defanged for safe publication. Malware-family labels are normalized from source activity tags.