CYBERRAKSHAK LABS · DAILY GLOBAL THREAT INTELLIGENCE

GTI Feed — 25 October 2026

Name: CyberRakshakLabs Daily Threat Intelligence Feed — 25 October 2026
Creator: CyberRakshakLabs
Published: 2026-10-24
License: https://cyberrakshaklabs.in/gti/license/

Daily defensive threat intelligence feed containing 100 source-provided, defanged indicators for 25 October 2026.

Table format: IoC · Severity · Confidence · Involved Threat Type · Malware / Family · Brief Attack Description

IoC	Severity	Confidence	Involved Threat Type	Malware / Family	Brief Attack Description
`hxxps://jtf[.]adilawa99[.]org/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://gmealshub[.]com/`	Critical	90/100	Payload Delivery	Unknown	Source classifies this indicator as a payload-delivery URL; malware family is listed as unknown.
`hxxps://chant98[.]com/curl/ep5z0u6c13/rlobwbmk92r8mbrg9.txt`	Critical	100/100	Payload Delivery	AMOS	Source classifies this URL as payload delivery associated with AMOS activity.
`hxxps://chant98[.]com/f/zh2s2xptaamrnzpdyiq0ng/vj1ury4s`	Critical	100/100	Payload Delivery	AMOS	Source classifies this URL as payload delivery associated with AMOS activity.
`hxxps://www[.]medecin-esthetique-visage[.]com/`	Critical	90/100	Payload Delivery	Unknown	Source classifies this indicator as a payload-delivery URL; malware family is listed as unknown.
`hxxps://c[.]adilawa99[.]org/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://556990[.]xyz/`	Critical	90/100	Payload Delivery	Unknown	Source classifies this indicator as a payload-delivery URL; malware family is listed as unknown.
`hxxps://administrationvisa[.]com/`	Critical	90/100	Payload Delivery	Unknown	Source classifies this indicator as a payload-delivery URL; malware family is listed as unknown.
`hxxp://196[.]251[.]107[.]186/8jdjZhdf7/index.php`	Critical	100/100	Botnet Cc	Amadey	Source classifies this indicator as botnet command-and-control associated with Amadey activity.
`hxxps://rf[.]adilawa99[.]org/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://milliondollaradjuster[.]com/`	Critical	90/100	Payload Delivery	Unknown	Source classifies this indicator as a payload-delivery URL; malware family is listed as unknown.
`hxxp://91[.]92[.]43[.]221/iranbot-ultimate.armv4l`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://91[.]92[.]43[.]221/iranbot-ultimate.mips`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://91[.]92[.]43[.]221/iranbot-ultimate.x86_32`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://91[.]92[.]43[.]221/iranbot-ultimate.mipsel`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://160[.]119[.]66[.]206/bins/net.arc`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://160[.]119[.]66[.]206/bins/net.arm`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://160[.]119[.]66[.]206/bins/net.arm5`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://160[.]119[.]66[.]206/bins/net.arm6`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://160[.]119[.]66[.]206/bins/net.arm7`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://160[.]119[.]66[.]206/bins/net.i486`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://160[.]119[.]66[.]206/bins/net.i686`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://160[.]119[.]66[.]206/bins/net.m68k`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://91[.]92[.]43[.]221/iranbot-ultimate.aarch64`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://31[.]56[.]209[.]86/x86_64`	Critical	100/100	Payload Delivery	Unknown	Source classifies this indicator as a payload-delivery URL; malware family is listed as unknown.
`hxxp://160[.]119[.]66[.]206/bins/net.mips`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://160[.]119[.]66[.]206/bins/net.mpsl`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://160[.]119[.]66[.]206/bins/net.ppc`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://160[.]119[.]66[.]206/bins/net.sh4`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://160[.]119[.]66[.]206/bins/net.x86`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://160[.]119[.]66[.]206/bins/net.x86_64`	Critical	100/100	Payload Delivery	Mirai	Source classifies this URL as payload delivery associated with Mirai activity.
`hxxp://213[.]232[.]114[.]14/bash`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/ext4`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/getty`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/gnome`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/kernal`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/kworker`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/ntp`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/ntpd`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/sshd`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/systemd`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/telnet`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/watchdogd`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/telnetd`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/nokillbins/bash`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/nokillbins/ext4`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/nokillbins/getty`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/nokillbins/gnome`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/nokillbins/kernal`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/nokillbins/kworker`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/nokillbins/ntp`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/nokillbins/ntpd`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/nokillbins/sshd`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/nokillbins/systemd`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/nokillbins/telnet`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/nokillbins/telnetd`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxp://213[.]232[.]114[.]14/nokillbins/watchdogd`	Critical	100/100	Payload Delivery	BashLite/Gafgyt	Source classifies this URL as payload delivery associated with BashLite/Gafgyt activity.
`hxxps://iy[.]acunbet89[.]org/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://fruit-overall[.]com/4qX0LB`	Critical	90/100	Payload Delivery	ClearFake	Source classifies this URL as payload delivery associated with ClearFake activity.
`hxxps://decoyanswer[.]com/4qX0LB`	Critical	90/100	Payload Delivery	ClearFake	Source classifies this URL as payload delivery associated with ClearFake activity.
`hxxps://egg-crusade[.]com/4qX0LB`	Critical	90/100	Payload Delivery	ClearFake	Source classifies this URL as payload delivery associated with ClearFake activity.
`hxxps://u7[.]ajo7[.]org/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://n[.]acunbet89[.]org/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://5[.]75[.]221[.]125`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://invitationfilecard[.]com/InfiAQ`	Critical	90/100	Payload Delivery	unknown RAT	Source classifies this URL as payload delivery associated with unknown RAT activity.
`hxxps://vmi3666256[.]contaboserver[.]net/`	Critical	100/100	Payload Delivery	Grandoreiro	Source classifies this URL as payload delivery associated with Grandoreiro activity.
`hxxps://vmi3666264[.]contaboserver[.]net/gSzenEEAgP03Z.php`	Critical	100/100	Payload Delivery	Grandoreiro	Source classifies this URL as payload delivery associated with Grandoreiro activity.
`hxxps://download-latest-ai-application[.]pages[.]dev/downloads/ChatGPT.exe`	Critical	100/100	Payload Delivery	StealC	Source classifies this URL as payload delivery associated with StealC activity.
`hxxps://claude-ai-fuliapi[.]pages[.]dev/downloads/latest.exe`	Critical	100/100	Payload Delivery	StealC	Source classifies this URL as payload delivery associated with StealC activity.
`hxxps://at[.]ajo7[.]org/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://mt[.]acunbet89[.]org/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://fastly[.]jsdelivr[.]net/gh/608-b8d3-712fc1654e/849-b650-bc87849c3/9e2f-5dc6c2ff5908`	Critical	100/100	Payload Delivery	ClearFake	Source classifies this URL as payload delivery associated with ClearFake activity.
`hxxps://k[.]ajo7[.]org/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://s6[.]acunbet89[.]org/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://c[.]ajo7[.]org/n/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://h8d[.]acunbet89[.]org/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://x[.]ajo7[.]org/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://x[.]acunbet89[.]org/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxp://212[.]83[.]185[.]19/footerd.png`	Critical	100/100	Payload Delivery	XMRig	Source classifies this URL as payload delivery associated with XMRig activity.
`hxxp://212[.]83[.]185[.]19/bottom-xe.png`	Critical	100/100	Payload Delivery	XMRig	Source classifies this URL as payload delivery associated with XMRig activity.
`hxxp://cqzbr8a4[.]requestrepo[.]com`	Critical	90/100	Botnet Cc	XMRig	Source classifies this indicator as botnet command-and-control associated with XMRig activity.
`hxxps://217[.]60[.]102[.]5/sh`	Critical	100/100	Payload Delivery	RedTail	Source classifies this URL as payload delivery associated with RedTail activity.
`hxxps://217[.]60[.]103[.]56/sh`	Critical	100/100	Payload Delivery	RedTail	Source classifies this URL as payload delivery associated with RedTail activity.
`hxxps://v[.]abc69[.]net/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://draft-loop[.]com/curl/vkyc5kzawsu/tteme4qj05viaz8rfh.txt`	Critical	100/100	Payload Delivery	AMOS	Source classifies this URL as payload delivery associated with AMOS activity.
`hxxps://draft-loop[.]com/f/qus5n9iecneukfdd5bqagg/8d5wkyb6`	Critical	100/100	Payload Delivery	AMOS	Source classifies this URL as payload delivery associated with AMOS activity.
`hxxps://n3[.]acunbet89[.]org/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://h0[.]acunbet89[.]org/r/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://h0[.]acunbet89[.]org/o/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://h0[.]acunbet89[.]org/p4/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://h0[.]acunbet89[.]org/b/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://tq[.]acplay99[.]org/qo/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://tq[.]acplay99[.]org/az/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://tq[.]acplay99[.]org/fm/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://tq[.]acplay99[.]org/k/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://tq[.]acplay99[.]org/k2/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://tq[.]acplay99[.]org/e4/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://tq[.]acplay99[.]org/tt/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://tq[.]acplay99[.]org/vu/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`hxxps://tq[.]acplay99[.]org/tb/`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.

Source: User-provided IOC feed export dated 25 October 2026. Confidence values (90/100–100/100) are source-provided, not independently calculated; IOCs are defanged for safe publication. Malware-family labels are normalized from source activity tags.

← Live GTI Feed GTI Archive →

Threat Score values are source-provided confidence values, not independently calculated by CyberRakshakLabs. Indicators are defanged for safe publication.