CYBERRAKSHAK LABS · DAILY GLOBAL THREAT INTELLIGENCE
GTI Feed — 31 October 2026
Daily defensive threat intelligence feed containing 100 source-provided, defanged indicators for 31 October 2026.
Table format: IoC · Severity · Confidence · Involved Threat Type · Malware / Family · Brief Attack Description
| IoC | Severity | Confidence | Involved Threat Type | Malware / Family | Brief Attack Description | |
|---|---|---|---|---|---|---|
| 1 | 154[.]91[.]51[.]188:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 2 | 154[.]91[.]50[.]189:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 3 | 154[.]91[.]51[.]186:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 4 | 154[.]91[.]51[.]187:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 5 | 154[.]91[.]50[.]187:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 6 | 154[.]91[.]50[.]186:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 7 | 154[.]91[.]49[.]170:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 8 | 154[.]91[.]50[.]164:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 9 | 154[.]91[.]50[.]185:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 10 | 154[.]91[.]50[.]184:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 11 | 154[.]91[.]50[.]182:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 12 | 154[.]91[.]50[.]181:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 13 | 154[.]91[.]50[.]169:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 14 | 154[.]91[.]50[.]166:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 15 | 154[.]91[.]50[.]167:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 16 | 213[.]176[.]72[.]224:80 | Critical | 100 | botnet_cc | win.smartloader | Source classifies this IP:port as botnet command-and-control associated with SmartLoader activity. |
| 17 | 154[.]91[.]49[.]168:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 18 | 154[.]91[.]48[.]190:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 19 | 154[.]91[.]49[.]162:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 20 | 154[.]91[.]48[.]188:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 21 | 154[.]91[.]48[.]189:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 22 | 154[.]91[.]51[.]184:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 23 | 154[.]91[.]51[.]185:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 24 | 154[.]91[.]51[.]181:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 25 | 154[.]91[.]51[.]182:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 26 | 154[.]91[.]51[.]183:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 27 | 151[.]243[.]137[.]99:443 | Critical | 100 | botnet_cc | unknown | Source classification: unknown; source threat type is botnet_cc. Source tags: AutoIT banker. |
| 28 | 118[.]107[.]44[.]67:8151 | Critical | 100 | botnet_cc | unknown_rat | Source classifies this indicator as unknown RAT activity. |
| 29 | 13[.]49[.]66[.]51:31337 | Critical | 100 | botnet_cc | win.sliver | Source classifies this IP:port as botnet command-and-control associated with Sliver activity. |
| 30 | 209[.]38[.]84[.]233:31337 | Critical | 100 | botnet_cc | win.sliver | Source classifies this IP:port as botnet command-and-control associated with Sliver activity. |
| 31 | 54[.]197[.]209[.]134:31337 | Critical | 100 | botnet_cc | win.sliver | Source classifies this IP:port as botnet command-and-control associated with Sliver activity. |
| 32 | 5[.]78[.]211[.]219:31337 | Critical | 100 | botnet_cc | win.sliver | Source classifies this IP:port as botnet command-and-control associated with Sliver activity. |
| 33 | 100[.]53[.]240[.]26:31337 | Critical | 100 | botnet_cc | win.sliver | Source classifies this IP:port as botnet command-and-control associated with Sliver activity. |
| 34 | 154[.]91[.]51[.]179:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 35 | 154[.]91[.]51[.]180:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 36 | 154[.]91[.]50[.]163:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 37 | 154[.]91[.]49[.]190:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 38 | 154[.]91[.]48[.]187:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 39 | 154[.]91[.]49[.]186:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 40 | 154[.]91[.]49[.]163:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 41 | 154[.]91[.]49[.]164:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 42 | 154[.]91[.]49[.]185:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 43 | 141[.]98[.]10[.]168:8443 | Critical | 100 | botnet_cc | unknown | Source classification: unknown; source threat type is botnet_cc. Source tags: botnet ddos. |
| 44 | 154[.]91[.]48[.]186:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 45 | 154[.]91[.]48[.]183:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 46 | 154[.]91[.]48[.]184:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 47 | 154[.]91[.]48[.]185:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 48 | 154[.]91[.]48[.]162:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 49 | 94[.]154[.]43[.]26:9145 | Critical | 100 | botnet_cc | unknown | Source classification: unknown; source threat type is botnet_cc. Source tags: botnet ddos. |
| 50 | 154[.]91[.]48[.]163:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 51 | 154[.]91[.]48[.]182:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 52 | 154[.]91[.]49[.]183:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 53 | 154[.]91[.]49[.]184:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 54 | 154[.]91[.]48[.]181:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 55 | 154[.]91[.]49[.]180:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 56 | 154[.]91[.]49[.]181:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 57 | 154[.]91[.]48[.]179:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 58 | 154[.]91[.]48[.]178:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 59 | 154[.]91[.]48[.]177:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 60 | 154[.]91[.]48[.]180:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 61 | 154[.]91[.]48[.]176:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 62 | 154[.]91[.]48[.]172:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 63 | 154[.]91[.]48[.]173:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 64 | 154[.]91[.]48[.]174:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 65 | 154[.]91[.]48[.]175:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 66 | 154[.]91[.]48[.]171:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 67 | 51[.]83[.]192[.]18:31337 | Critical | 100 | botnet_cc | win.sliver | Source classifies this IP:port as botnet command-and-control associated with Sliver activity. |
| 68 | 47[.]102[.]40[.]187:31337 | Critical | 100 | botnet_cc | win.sliver | Source classifies this IP:port as botnet command-and-control associated with Sliver activity. |
| 69 | 45[.]32[.]39[.]157:31337 | Critical | 100 | botnet_cc | win.sliver | Source classifies this IP:port as botnet command-and-control associated with Sliver activity. |
| 70 | 185[.]220[.]213[.]46:31337 | Critical | 100 | botnet_cc | win.sliver | Source classifies this IP:port as botnet command-and-control associated with Sliver activity. |
| 71 | 108[.]61[.]247[.]185:31337 | Critical | 100 | botnet_cc | win.sliver | Source classifies this IP:port as botnet command-and-control associated with Sliver activity. |
| 72 | 154[.]91[.]48[.]168:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 73 | 154[.]91[.]48[.]169:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 74 | 154[.]91[.]48[.]170:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 75 | 154[.]91[.]48[.]167:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 76 | 154[.]91[.]48[.]166:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 77 | 159[.]223[.]66[.]236:443 | Critical | 100 | botnet_cc | elf.jackskid | Source classifies this IP:port as botnet command-and-control associated with Jackskid activity. |
| 78 | 159[.]65[.]197[.]205:443 | Critical | 100 | botnet_cc | elf.jackskid | Source classifies this IP:port as botnet command-and-control associated with Jackskid activity. |
| 79 | 168[.]144[.]241[.]131:443 | Critical | 100 | botnet_cc | elf.jackskid | Source classifies this IP:port as botnet command-and-control associated with Jackskid activity. |
| 80 | 18[.]190[.]253[.]142:80 | Critical | 100 | botnet_cc | win.adaptix_c2 | Source classifies this IP:port as botnet command-and-control associated with Adaptix C2 activity. |
| 81 | 18[.]190[.]253[.]142:8080 | Critical | 100 | botnet_cc | win.adaptix_c2 | Source classifies this IP:port as botnet command-and-control associated with Adaptix C2 activity. |
| 82 | 18[.]190[.]253[.]142:443 | Critical | 100 | botnet_cc | win.adaptix_c2 | Source classifies this IP:port as botnet command-and-control associated with Adaptix C2 activity. |
| 83 | 154[.]91[.]55[.]168:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 84 | 165[.]22[.]61[.]69:80 | Critical | 100 | botnet_cc | win.cobalt_strike | Source classifies this IP:port as botnet command-and-control associated with Cobalt Strike. |
| 85 | 165[.]22[.]61[.]69:443 | Critical | 100 | botnet_cc | win.cobalt_strike | Source classifies this IP:port as botnet command-and-control associated with Cobalt Strike. |
| 86 | 154[.]91[.]55[.]167:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 87 | 154[.]91[.]54[.]182:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 88 | 154[.]91[.]54[.]183:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 89 | 154[.]91[.]54[.]176:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 90 | 154[.]91[.]54[.]181:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 91 | 154[.]91[.]54[.]175:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 92 | 154[.]91[.]53[.]167:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 93 | 154[.]91[.]53[.]168:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 94 | 154[.]91[.]52[.]188:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 95 | 154[.]91[.]52[.]183:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 96 | 154[.]91[.]52[.]176:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 97 | 154[.]91[.]52[.]181:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 98 | 154[.]91[.]49[.]169:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 99 | 154[.]91[.]49[.]179:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
| 100 | 154[.]91[.]49[.]167:9097 | Critical | 100 | botnet_cc | win.vshell | Source classifies this IP:port as botnet command-and-control associated with VShell activity. |
Source: User-provided IOC feed export dated 31 October 2026. Confidence values (90/100–100/100) are source-provided, not independently calculated; IOCs are defanged for safe publication. Malware-family labels are normalized from source activity tags.
Threat Score values are source-provided confidence values, not independently calculated by CyberRakshakLabs. Indicators are defanged for safe publication.