{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/domain/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["maltrail","ioc","domain","ip"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eOn 2026-02-19, the Maltrail feed identified a series of new malicious domains and IP addresses involved in suspicious network activity. This activity is likely related to ongoing campaigns aimed at delivering malware, conducting phishing attacks, or establishing command and control infrastructure. The identified domains use various techniques, including the generation of seemingly random character strings and the exploitation of coupon-related themes. The diverse naming schemes suggests a broad targeting scope rather than a single, focused campaign. Defenders should monitor and block these indicators to prevent potential compromise of their systems. Due to the nature of the Maltrail feed, specific attribution and campaign details are not available; however, proactive blocking of these indicators is crucial.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access:\u003c/strong\u003e Users unknowingly visit or are redirected to malicious domains (e.g., koover.org, tributj.cyou, activebrain.conscious86jag.coupons).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRedirection:\u003c/strong\u003e The initial domain may redirect the user to other malicious sites or serve malicious content directly.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExploitation (Possible):\u003c/strong\u003e If the user's system has unpatched vulnerabilities, the attacker may attempt to exploit them through drive-by download techniques.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMalware Delivery:\u003c/strong\u003e A malicious payload (e.g., trojan, infostealer) is delivered to the victim's system.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInstallation:\u003c/strong\u003e The malware installs itself on the system, often using persistence mechanisms to ensure it runs after reboot.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCommand and Control:\u003c/strong\u003e The malware establishes communication with a command and control (C2) server using IP addresses such as 144.31.238.37 and 85.137.253.64.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eData Exfiltration/Malicious Activity:\u003c/strong\u003e The attacker uses the compromised system to exfiltrate sensitive data or perform other malicious activities, such as lateral movement within the network.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful attack using these indicators could lead to data breaches, financial losses, and reputational damage. The wide range of domains suggests a broad targeting scope, potentially impacting numerous organizations and individuals. Compromised systems could be used to launch further attacks, spreading the malware to other victims. Given the lack of specific victimology in the source data, the potential impact is difficult to quantify, but defenders should treat these indicators as high priority.\u003c/p\u003e\n","date_modified":"2026-02-19T16:36:58Z","date_published":"2026-02-19T16:36:58Z","id":"https://feed.craftedsignal.io/briefs/2026-02-19-maltrail-iocs/","summary":"This brief covers newly identified malicious domains and IPs from the Maltrail feed on 2026-02-19, which are actively being used in various campaigns to deliver malware and facilitate command and control.","title":"Maltrail Feed IOCs Targeting Multiple Verticals","url":"https://feed.craftedsignal.io/briefs/2026-02-19-maltrail-iocs/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["maltrail","network-ioc","domain","ip-address"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eOn February 18, 2026, the Maltrail feed reported a series of newly observed network indicators, primarily consisting of newly registered domains and a single IP address. These indicators may represent command-and-control infrastructure, phishing sites, or other malicious activities. The domains exhibit patterns suggestive of dynamically generated names, possibly to evade detection. While the exact nature of the threat is not explicitly defined in the report, the sudden appearance of these domains and the IP address warrants investigation to determine if they are associated with ongoing campaigns or emerging threats. This activity requires monitoring to assess its potential impact and prevent malicious activity.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003cp\u003eDue to the limited information available from the Maltrail feed, the complete attack chain cannot be definitively established. However, based on the types of indicators observed, a hypothetical attack chain can be constructed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Compromise (Possible):\u003c/strong\u003e A user may receive a phishing email or visit a compromised website.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRedirection:\u003c/strong\u003e The user clicks a link that redirects to one of the newly observed domains.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMalware Delivery (Possible):\u003c/strong\u003e The domain hosts malware or exploits a vulnerability on the user's system to install malware.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCommand and Control:\u003c/strong\u003e The malware communicates with the IP address \u003ccode\u003e212.111.89.17\u003c/code\u003e to receive instructions from the attacker.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLateral Movement (Possible):\u003c/strong\u003e The malware attempts to spread to other systems on the network.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eData Exfiltration or Damage (Possible):\u003c/strong\u003e The malware exfiltrates sensitive data or causes damage to the compromised systems.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe impact of these indicators is potentially broad, depending on the attacker's objectives. If these domains and the IP address are indeed associated with malicious activity, successful exploitation could lead to data theft, system compromise, and financial losses. The nature of the domain names suggests a possible phishing or malvertising campaign, targeting unsuspecting users. Without further analysis, it is difficult to determine the scale and scope of the potential impact.\u003c/p\u003e\n","date_modified":"2026-02-18T23:44:32Z","date_published":"2026-02-18T23:44:32Z","id":"https://feed.craftedsignal.io/briefs/2026-02-18-maltrail-iocs/","summary":"This brief details newly observed network activity, specifically a list of domains and one IP address, reported by the Maltrail feed on February 18, 2026, potentially indicating emerging threats or malicious infrastructure.","title":"Maltrail Feed - Newly Observed Domains and IP Address","url":"https://feed.craftedsignal.io/briefs/2026-02-18-maltrail-iocs/"}],"language":"en","title":"CraftedSignal Threat Feed - Domain","version":"https://jsonfeed.org/version/1.1"}