CYBERRAKSHAK LABS · DAILY GLOBAL THREAT INTELLIGENCE

GTI Feed — 28 October 2026

Name: CyberRakshakLabs Daily Threat Intelligence Feed — 28 October 2026
Creator: CyberRakshakLabs
Published: 2026-10-28
License: https://cyberrakshaklabs.in/gti/license/

Daily defensive threat intelligence feed containing 100 source-provided, defanged indicators for 28 October 2026.

Table format: IoC · Severity · Confidence · Involved Threat Type · Malware / Family · Brief Attack Description

IoC	Severity	Confidence	Involved Threat Type	Malware / Family	Brief Attack Description
`5v8ryehz[.]worknernorgram[.]rest`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`akumaqqq[.]xyz`	Critical	100/100	Botnet Cc	Unknown	Source classifies this indicator as unknown stealer activity.
`et[.]aeon888link[.]org`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`shebei[.]sellingate[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`k0v5zt7p[.]verticalrewards[.]com`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`larpestan[.]duckdns[.]org`	Critical	95/100	Botnet Cc	Unknown	Source classifies this indicator as unknown RAT activity.
`4gzdhrn8[.]epexecutivecoaching[.]com`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`study[.]goldenpeak[.]edu[.]np`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`j0[.]bala7[.]org`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`rcguk[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`parotide[.]eu`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`xuun[.]net`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`www[.]wtthru[.]co[.]th`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`www[.]wesolerobaczki[.]pl`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`9qhklald[.]enfejar[.]casino`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`www[.]shanecrossweb[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`www[.]pacanaturals[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`q3[.]aeon888link[.]org`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`www[.]organicsplususa[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`www[.]nickbrownart[.]net`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`www[.]newratu[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`rot85xe6[.]yellohotelsharmoni[.]com`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`www[.]negociosliterarios[.]com[.]tacetbooks[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`www[.]mojomama[.]org`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`www[.]markcode[.]my`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`hrv8ks0h[.]urgentblue[.]com`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`iz6jswi0[.]forbesae[.]com`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`forbesae[.]com`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`www[.]mitrasedjati[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`www[.]marianoturcutto[.]turcutto[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`www[.]metodobertele[.]it`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`jj[.]bala7[.]org`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`www[.]leavenworthlofts[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`www[.]kashisansadkhelkud[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`www[.]joezsingin[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`www[.]joenyc[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`www[.]i-show[.]co[.]il`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`www[.]japaneseknifeguide[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`preachit[.]feettogo[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`www[.]gestorianaveiras[.]es`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`theblackteachronicles[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`ryandesigner[.]infinityfree[.]me`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`x7onu4r4[.]slotsensi138[.]org`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`www[.]reparacioneshosteleria[.]es`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`www[.]anicelife[.]net`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`l0[.]aeon888link[.]org`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`yw[.]bala7[.]org`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`koa1sb08[.]forgestudios[.]co`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`forgestudios[.]co`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`www[.]amena-gps[.]tn`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`wuddmackh[.]co[.]ug`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`gg8gdk7e[.]sleavepiker[.]com`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`www[.]alessandrofamiani[.]it`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`k2im6qzv[.]warmwaffles[.]com`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`gargiulobuilders[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`amaze[.]printedsimply[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`wahyutehnikutama[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`www[.]mufasatoto[.]site`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`www[.]kcde-ks[.]org`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`www[.]zeus138[.]io`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`www[.]kupas78[.]guru`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`550316[.]us16[.]myftpupload[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`www[.]instalacionesrenovables[.]com`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`thi-revetement[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`tacosymotos[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`staging[.]physiciansforpeace[.]ph`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`p[.]bala7[.]org`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`malo-coaching[.]ch`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`3imyvvfh[.]slavyera[.]com`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`bridge73[.]com`	Critical	100/100	Payload Delivery	Amos	Source classifies this indicator as payload delivery associated with Amos activity.
`xh8tunnv[.]paars[.]poker`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`tzps[.]pl`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`tsm[.]norstrilia[.]net`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`v8[.]aeon888link[.]org`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`trejosroofing[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`sbr7xjmp[.]exploreargentina[.]tours`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`zen-castle-depth-gas[.]xyz`	Critical	90/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`thecoolwhpos[.]de`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`textilras[.]com[.]ar`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`tetrahedralflowers[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`teste[.]atctecnologia[.]com[.]br`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`swgnj9q0[.]mon-iam-espace-esa-lia[.]online`	Critical	100/100	Payload Delivery	Clearfake	Source classifies this indicator as payload delivery associated with Clearfake activity.
`test[.]fbmeliquidation[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`telegraphharp[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`i[.]bala7[.]org`	Critical	100/100	Botnet Cc	Vidar	Source classifies this indicator as botnet command-and-control associated with Vidar activity.
`tailorexecutive[.]kastner[.]com[.]au`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`synchro-vasq[.]unidermaperu[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`svpmag[.]ru`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`tamarackhenge[.]org`	Critical	100/100	Payload Delivery	Smartapesg	Source classifies this indicator as payload delivery associated with Smartapesg activity.
`fortwayneswoodfloorcleaner[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`strangemeteor[.]com`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`lekkie[.]przesuniecie[.]pl`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`karpikgnc[.]com[.]ar`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.
`megakefir[.]duckdns[.]org`	Critical	100/100	Botnet Cc	Xoriumstealer	Source classifies this indicator as botnet command-and-control associated with Xoriumstealer activity.
`wifisucks[.]duckdns[.]org`	Critical	100/100	Botnet Cc	Xoriumstealer	Source classifies this indicator as botnet command-and-control associated with Xoriumstealer activity.
`coffeetocode[.]duckdns[.]org`	Critical	100/100	Botnet Cc	Xoriumstealer	Source classifies this indicator as botnet command-and-control associated with Xoriumstealer activity.
`arvion[.]network`	Critical	100/100	Botnet Cc	Unknown	Source classifies this indicator as unknown RAT activity.
`apache-update[.]ddns[.]net`	Critical	100/100	Botnet Cc	Tsunami	Source classifies this indicator as botnet command-and-control associated with Tsunami activity.
`apache-update[.]csproject[.]org`	Critical	100/100	Botnet Cc	Tsunami	Source classifies this indicator as botnet command-and-control associated with Tsunami activity.
`staging[.]lisadegen[.]de`	Critical	100/100	Payload Delivery	Strelastealer	Source classifies this indicator as payload delivery associated with Strelastealer activity.

Source: User-provided IOC feed export dated 28 October 2026. Confidence values (90/100–100/100) are source-provided, not independently calculated; IOCs are defanged for safe publication. Malware-family labels are normalized from source activity tags.

← Live GTI Feed GTI Archive →

Threat Score values are source-provided confidence values, not independently calculated by CyberRakshakLabs. Indicators are defanged for safe publication.