CYBERRAKSHAK LABS · DAILY GLOBAL THREAT INTELLIGENCE
GTI Feed — 4 November 2026
Daily defensive threat intelligence feed containing 100 source-provided, defanged indicators for 4 November 2026.
Table format: IoC · Severity · Confidence · Involved Threat Type · Malware / Family · Brief Attack Description
| IoC | Severity | Confidence | Involved Threat Type | Malware / Family | Brief Attack Description |
|---|---|---|---|---|---|
| 193[.]187[.]91[.]224:50810 | Critical | 100 | Botnet / C2 | win.remcos | Source classifies this indicator as botnet command-and-control associated with remcos activity. |
| 31[.]59[.]137[.]16:3998 | Critical | 100 | Botnet / C2 | win.nanocore | Source classifies this indicator as botnet command-and-control associated with nanocore activity. |
| 20[.]235[.]65[.]170:50001 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 47[.]110[.]227[.]98:2222 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 23[.]254[.]226[.]103:22 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 107[.]173[.]21[.]218:8085 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 2[.]29[.]151[.]245:443 | Critical | 100 | Botnet / C2 | win.vidar | Source classifies this indicator as botnet command-and-control associated with vidar activity. |
| 95[.]216[.]197[.]0:443 | Critical | 100 | Botnet / C2 | win.vidar | Source classifies this indicator as botnet command-and-control associated with vidar activity. |
| 2[.]29[.]145[.]248:443 | Critical | 100 | Botnet / C2 | win.vidar | Source classifies this indicator as botnet command-and-control associated with vidar activity. |
| 2[.]29[.]159[.]106:443 | Critical | 100 | Botnet / C2 | win.vidar | Source classifies this indicator as botnet command-and-control associated with vidar activity. |
| 2[.]29[.]157[.]217:443 | Critical | 100 | Botnet / C2 | win.vidar | Source classifies this indicator as botnet command-and-control associated with vidar activity. |
| 159[.]69[.]176[.]1:443 | Critical | 100 | Botnet / C2 | win.vidar | Source classifies this indicator as botnet command-and-control associated with vidar activity. |
| 2[.]29[.]152[.]8:443 | Critical | 100 | Botnet / C2 | win.vidar | Source classifies this indicator as botnet command-and-control associated with vidar activity. |
| 109[.]110[.]170[.]72:443 | Critical | 100 | Botnet / C2 | elf.jackskid | Source classifies this indicator as botnet command-and-control associated with jackskid activity. |
| 8[.]141[.]88[.]204:60000 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 217[.]60[.]102[.]78:2404 | Critical | 100 | Botnet / C2 | win.remcos | Source classifies this indicator as botnet command-and-control associated with remcos activity. |
| 47[.]239[.]109[.]26:8080 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 47[.]239[.]109[.]26:80 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 47[.]239[.]109[.]26:22 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 47[.]239[.]109[.]26:443 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 23[.]254[.]226[.]103:8080 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 23[.]254[.]226[.]103:443 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 112[.]213[.]110[.]225:443 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 202[.]95[.]13[.]142:6666 | Critical | 100 | Botnet / C2 | win.valley_rat | Source classifies this indicator as botnet command-and-control associated with valley_rat activity. |
| 45[.]192[.]99[.]236:443 | Critical | 100 | Botnet / C2 | unknown | Source classification: unknown; source threat type is botnet_cc. |
| 159[.]75[.]91[.]47:8081 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 168[.]144[.]176[.]164:443 | Critical | 100 | Botnet / C2 | elf.jackskid | Source classifies this indicator as botnet command-and-control associated with jackskid activity. |
| 64[.]81[.]30[.]24:443 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 170[.]64[.]153[.]147:443 | Critical | 100 | Botnet / C2 | elf.jackskid | Source classifies this indicator as botnet command-and-control associated with jackskid activity. |
| 188[.]166[.]233[.]203:443 | Critical | 100 | Botnet / C2 | elf.jackskid | Source classifies this indicator as botnet command-and-control associated with jackskid activity. |
| 45[.]76[.]145[.]171:443 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 49[.]235[.]179[.]14:443 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 101[.]34[.]218[.]233:8084 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 49[.]235[.]172[.]25:443 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 156[.]238[.]237[.]103:443 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 49[.]234[.]47[.]190:443 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 124[.]221[.]142[.]210:443 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 45[.]128[.]12[.]14:2053 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 184[.]64[.]22[.]194:5000 | Critical | 100 | Botnet / C2 | win.quasar_rat | Source classifies this indicator as botnet command-and-control associated with quasar_rat activity. |
| 45[.]154[.]98[.]118:2404 | Critical | 100 | Botnet / C2 | win.remcos | Source classifies this indicator as botnet command-and-control associated with remcos activity. |
| 45[.]83[.]31[.]203:1177 | Critical | 100 | Botnet / C2 | win.xworm | Source classifies this indicator as botnet command-and-control associated with xworm activity. |
| 91[.]92[.]47[.]220:222 | Critical | 100 | Botnet / C2 | unknown | Source classification: unknown; source threat type is botnet_cc. |
| 91[.]92[.]42[.]84:9999 | Critical | 100 | Botnet / C2 | unknown | Source classification: unknown; source threat type is botnet_cc. |
| 85[.]11[.]167[.]41:9999 | Critical | 100 | Botnet / C2 | unknown | Source classification: unknown; source threat type is botnet_cc. |
| 43[.]155[.]171[.]8:8880 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 38[.]147[.]172[.]79:7443 | Critical | 100 | Botnet / C2 | unknown | Source classification: unknown; source threat type is botnet_cc. |
| 103[.]164[.]81[.]65:6667 | Critical | 100 | Botnet / C2 | win.valley_rat | Source classifies this indicator as botnet command-and-control associated with valley_rat activity. |
| 45[.]128[.]156[.]112:8080 | Critical | 100 | Botnet / C2 | win.adaptix_c2 | Source classifies this indicator as botnet command-and-control associated with adaptix_c2 activity. |
| 45[.]128[.]156[.]112:80 | Critical | 100 | Botnet / C2 | win.adaptix_c2 | Source classifies this indicator as botnet command-and-control associated with adaptix_c2 activity. |
| 94[.]26[.]83[.]60:8080 | Critical | 100 | Botnet / C2 | win.adaptix_c2 | Source classifies this indicator as botnet command-and-control associated with adaptix_c2 activity. |
| 94[.]26[.]83[.]60:80 | Critical | 100 | Botnet / C2 | win.adaptix_c2 | Source classifies this indicator as botnet command-and-control associated with adaptix_c2 activity. |
| 96[.]62[.]250[.]235:443 | Critical | 100 | Botnet / C2 | elf.jackskid | Source classifies this indicator as botnet command-and-control associated with jackskid activity. |
| 96[.]62[.]250[.]234:443 | Critical | 100 | Botnet / C2 | elf.jackskid | Source classifies this indicator as botnet command-and-control associated with jackskid activity. |
| 96[.]62[.]250[.]236:443 | Critical | 100 | Botnet / C2 | elf.jackskid | Source classifies this indicator as botnet command-and-control associated with jackskid activity. |
| 96[.]62[.]250[.]237:443 | Critical | 100 | Botnet / C2 | elf.jackskid | Source classifies this indicator as botnet command-and-control associated with jackskid activity. |
| 96[.]62[.]250[.]238:443 | Critical | 100 | Botnet / C2 | elf.jackskid | Source classifies this indicator as botnet command-and-control associated with jackskid activity. |
| 94[.]26[.]83[.]60:443 | Critical | 100 | Botnet / C2 | win.adaptix_c2 | Source classifies this indicator as botnet command-and-control associated with adaptix_c2 activity. |
| 157[.]137[.]227[.]61:8081 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 89[.]110[.]77[.]130:80 | Critical | 100 | Botnet / C2 | win.adaptix_c2 | Source classifies this indicator as botnet command-and-control associated with adaptix_c2 activity. |
| 89[.]110[.]77[.]130:8080 | Critical | 100 | Botnet / C2 | win.adaptix_c2 | Source classifies this indicator as botnet command-and-control associated with adaptix_c2 activity. |
| 64[.]89[.]160[.]29:55045 | Critical | 100 | Botnet / C2 | win.nanocore | Source classifies this indicator as botnet command-and-control associated with nanocore activity. |
| 217[.]60[.]102[.]231:2404 | Critical | 100 | Botnet / C2 | win.remcos | Source classifies this indicator as botnet command-and-control associated with remcos activity. |
| 45[.]61[.]182[.]54:8080 | Critical | 100 | Payload Delivery | win.data_exfiltrator | Source classifies this indicator as payload delivery associated with data_exfiltrator activity. |
| 89[.]110[.]77[.]130:443 | Critical | 100 | Botnet / C2 | win.adaptix_c2 | Source classifies this indicator as botnet command-and-control associated with adaptix_c2 activity. |
| 149[.]56[.]95[.]138:30305 | Critical | 100 | Botnet / C2 | win.asyncrat | Source classifies this indicator as botnet command-and-control associated with asyncrat activity. |
| 157[.]137[.]227[.]61:80 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 157[.]137[.]227[.]61:8080 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 39[.]107[.]50[.]187:8443 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 104[.]251[.]122[.]121:4443 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 157[.]137[.]227[.]61:22 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 157[.]137[.]227[.]61:443 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 104[.]251[.]122[.]121:8080 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 51[.]89[.]166[.]173:30001 | Critical | 100 | Botnet / C2 | win.nanocore | Source classifies this indicator as botnet command-and-control associated with nanocore activity. |
| 165[.]154[.]205[.]34:443 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 45[.]192[.]213[.]11:443 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 23[.]95[.]242[.]55:443 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 106[.]75[.]209[.]40:443 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 43[.]251[.]102[.]131:6598 | Critical | 100 | Botnet / C2 | win.valley_rat | Source classifies this indicator as botnet command-and-control associated with valley_rat activity. |
| 43[.]255[.]159[.]93:6666 | Critical | 100 | Botnet / C2 | win.valley_rat | Source classifies this indicator as botnet command-and-control associated with valley_rat activity. |
| 89[.]40[.]31[.]3:8080 | Critical | 100 | Botnet / C2 | win.vjw0rm | Source classifies this indicator as botnet command-and-control associated with vjw0rm activity. |
| 64[.]224[.]17[.]29:19900 | Critical | 100 | Botnet / C2 | win.vjw0rm | Source classifies this indicator as botnet command-and-control associated with vjw0rm activity. |
| 198[.]206[.]152[.]4:2404 | Critical | 100 | Botnet / C2 | win.remcos | Source classifies this indicator as botnet command-and-control associated with remcos activity. |
| 31[.]56[.]209[.]226:2404 | Critical | 100 | Botnet / C2 | win.remcos | Source classifies this indicator as botnet command-and-control associated with remcos activity. |
| 81[.]71[.]128[.]221:12876 | Critical | 100 | Botnet / C2 | win.njrat | Source classifies this indicator as botnet command-and-control associated with njrat activity. |
| 103[.]26[.]77[.]17:13954 | Critical | 100 | Botnet / C2 | win.njrat | Source classifies this indicator as botnet command-and-control associated with njrat activity. |
| 104[.]251[.]122[.]121:80 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 104[.]251[.]122[.]121:443 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 104[.]251[.]122[.]121:22 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 165[.]154[.]232[.]29:8443 | Critical | 100 | Botnet / C2 | win.adaptix_c2 | Source classifies this indicator as botnet command-and-control associated with adaptix_c2 activity. |
| 165[.]154[.]232[.]29:80 | Critical | 100 | Botnet / C2 | win.adaptix_c2 | Source classifies this indicator as botnet command-and-control associated with adaptix_c2 activity. |
| 165[.]154[.]232[.]29:8080 | Critical | 100 | Botnet / C2 | win.adaptix_c2 | Source classifies this indicator as botnet command-and-control associated with adaptix_c2 activity. |
| 106[.]75[.]249[.]202:9900 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 165[.]154[.]232[.]29:443 | Critical | 100 | Botnet / C2 | win.adaptix_c2 | Source classifies this indicator as botnet command-and-control associated with adaptix_c2 activity. |
| 68[.]183[.]236[.]229:80 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 68[.]183[.]236[.]229:8080 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 68[.]183[.]236[.]229:443 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 68[.]183[.]236[.]229:22 | Critical | 100 | Botnet / C2 | win.cobalt_strike | Source classifies this indicator as botnet command-and-control associated with cobalt_strike activity. |
| 59[.]110[.]172[.]210:8889 | Critical | 100 | Botnet / C2 | win.vshell | Source classifies this indicator as botnet command-and-control associated with vshell activity. |
| 91[.]98[.]109[.]169:443 | Critical | 100 | Botnet / C2 | win.vidar | Source classifies this indicator as botnet command-and-control associated with vidar activity. |
| 65[.]108[.]151[.]130:443 | Critical | 100 | Botnet / C2 | win.vidar | Source classifies this indicator as botnet command-and-control associated with vidar activity. |
Source: User-provided IOC feed export dated 4 November 2026. Threat Score is the source-provided confidence value, not an independently calculated CyberRakshakLabs score. IOCs are defanged for safe publication.
Threat Score values are source-provided confidence values, not independently calculated by CyberRakshakLabs. Indicators are defanged for safe publication.