CYBERRAKSHAK LABS · DAILY GLOBAL THREAT INTELLIGENCE

GTI Feed — 27 October 2026

Name: CyberRakshakLabs Daily Threat Intelligence Feed — 27 October 2026
Creator: CyberRakshakLabs
Published: 2026-10-27
License: https://cyberrakshaklabs.in/gti/license/

Daily defensive threat intelligence feed containing 100 source-provided, defanged indicators for 27 October 2026.

Table format: IoC · Severity · Confidence · Involved Threat Type · Malware / Family · Brief Attack Description

IoC	Severity	Confidence	Involved Threat Type	Malware / Family	Brief Attack Description
`despina[.]ph`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`d1muwuka[.]frameless1[.]shop`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`www[.]amberblogs[.]au`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`www[.]bran[.]lol`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`www[.]playasdealmeria[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`www[.]ots-training[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`www[.]vocalmedia[.]in`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`frameless1[.]shop`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`dec-llc[.]net`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`o[.]adwgamestore[.]org`	Critical	100/100	Botnet Cc	Vidar	Source classifies this domain as botnet command-and-control associated with Vidar activity.
`dbperformance[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`constructoraags[.]com[.]do`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`hp3zguzu[.]forgestudios[.]co`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`clinicadivinoninojesus[.]org[.]pe`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`clinicavetcenter[.]com[.]br`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`askhr[.]ch`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`centrealestetic[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`b[.]ayu99[.]pro`	Critical	100/100	Botnet Cc	Vidar	Source classifies this domain as botnet command-and-control associated with Vidar activity.
`catsport[.]it`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`gs4t5c3u[.]worknernorgram[.]rest`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`codes[.]caffe-img[.]com`	Critical	100/100	Payload Delivery	Iclickfix	Source classifies this domain as payload delivery associated with Iclickfix activity.
`sportouverte[.]ch`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`burnoutblog[.]lieselotmaes[.]be`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`nyt9xvyx[.]persiianabet[.]com`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`bluedoggdesign[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`gq59bezr[.]energedia[.]foundation`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`onepage-basic[.]hoverdroids[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`airport-homes[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`new[.]blagovmr[.]ru`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`www[.]businessdevelopmentgermany[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`majastee[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`ga[.]adwgamestore[.]org`	Critical	100/100	Botnet Cc	Vidar	Source classifies this domain as botnet command-and-control associated with Vidar activity.
`z0bhclq0[.]energedia[.]dev`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`zfvg0vcv[.]forbesae[.]com`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`nt5kwuux[.]paars[.]poker`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`cinchcoalition[.]org`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`www[.]cbl-wetterau[.]de`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`ilovevirginiabeer[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`imhoteplukata[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`iict[.]gov[.]la`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`k2rf8oi3[.]energedia[.]com`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`idrive[.]ba`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`garden-82[.]com`	Critical	100/100	Payload Delivery	Amos	Source classifies this domain as payload delivery associated with Amos activity.
`www[.]balancedprofessional[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`mac-check[.]pages[.]dev`	Critical	90/100	Payload Delivery	Unknown	Source classification: unknown; source threat type: payload_delivery.
`buccarella-sicherheit[.]ch`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`rapports[.]joset-telematique[.]ch`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`tpiuc[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`smkn1tabanan[.]sch[.]id`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`jj[.]adwgamestore[.]org`	Critical	100/100	Botnet Cc	Vidar	Source classifies this domain as botnet command-and-control associated with Vidar activity.
`gventerpriseswork[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`grant[.]vandersee[.]id[.]au`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`balsamdolmen[.]org`	Critical	100/100	Payload Delivery	Smartapesg	Source classifies this domain as payload delivery associated with Smartapesg activity.
`www[.]qatestinglaboratories[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`www[.]smartchild[.]sk`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`sahaaluminyum[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`nerovouvalos[.]eu`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`kostastina[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`www[.]coonfiance[.]com[.]br`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`vaiksed[.]ee`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`yantratechzone[.]in`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`globalfinancetalent[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`pulse[.]festival[.]mayapillot[.]fr`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`2gogame[.]se`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`qescoonlinebill[.]se`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`5gs2zjcc[.]fazbet1[.]app`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`globalintermed[.]com[.]br`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`c5568623b3[.]nxcli[.]io`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`www[.]ambizioneviaggi[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`702490[.]us28[.]myftpupload[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`www[.]riabitarelasardegna[.]it`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`jewels[.]awkwardmedia[.]ca`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`www[.]asacor[.]com[.]ar`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`www[.]saludseguro[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`lovecutessss[.]top`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`bl4ckyhills[.]com`	Critical	90/100	Payload Delivery	Unknown	Source classification: unknown; source threat type: payload_delivery.
`pm3c7bwl[.]encompass-graphics[.]co[.]uk`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`zz-infratechniek[.]nl`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`galerie-dakoenig[.]de`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`3cb50pyi[.]warmwaffles[.]com`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`hu406sua[.]ozabet[.]promo`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`francescmarcalvaro[.]cat`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`formazionedocenti[.]org`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`flexyyservices[.]pt`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`familylegacyprotection[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this domain as payload delivery associated with Strelastealer activity.
`cpw81zy7[.]emanuellejaques[.]com`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`ftp[.]jmacsafety[.]com`	Critical	100/100	Botnet Cc	Agent Tesla	Source classifies this domain as botnet command-and-control associated with Agent Tesla activity.
`figieiredo[.]lol`	Critical	100/100	Payload Delivery	Kongtuke	Source classifies this domain as payload delivery associated with Kongtuke activity.
`firebase[.]emeraldpineventuresllc[.]com`	Critical	100/100	Botnet Cc	Fakeupdates	Source classifies this domain as botnet command-and-control associated with Fakeupdates activity.
`ya[.]adwgamestore[.]org`	Critical	100/100	Botnet Cc	Vidar	Source classifies this domain as botnet command-and-control associated with Vidar activity.
`ab41vc541fd04435740[.]health-carereform[.]com`	Critical	100/100	Botnet Cc	Grandoreiro	Source classifies this domain as botnet command-and-control associated with Grandoreiro activity.
`3413718a[.]exploreargentina[.]tours`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`bbwptlox[.]dota[.]pw`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`tuffcromlech[.]info`	Critical	100/100	Payload Delivery	Smartapesg	Source classifies this domain as payload delivery associated with Smartapesg activity.
`anj99u86[.]verticalrewards[.]com`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`ftp[.]prometeon[.]info`	Critical	100/100	Botnet Cc	Agent Tesla	Source classifies this domain as botnet command-and-control associated with Agent Tesla activity.
`ioypdsgj[.]dota[.]pw`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`td3avpdc[.]dota[.]pw`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`t0kmixg4[.]glas-design[.]shop`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this domain as payload delivery associated with Clearfake activity.
`vm[.]adwgamestore[.]org`	Critical	100/100	Botnet Cc	Vidar	Source classifies this domain as botnet command-and-control associated with Vidar activity.

Source: User-provided IOC feed export dated 27 October 2026. Confidence values (90/100–100/100) are source-provided, not independently calculated; IOCs are defanged for safe publication. Malware-family labels are normalized from source activity tags.

← Live GTI Feed GTI Archive →

Threat Score values are source-provided confidence values, not independently calculated by CyberRakshakLabs. Indicators are defanged for safe publication.