Domain - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/domain/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 19 Feb 2026 16:36:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMaltrail Feed IOCs Targeting Multiple Verticalshttps://feed.craftedsignal.io/briefs/2026-02-19-maltrail-iocs/Thu, 19 Feb 2026 16:36:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-02-19-maltrail-iocs/This brief covers newly identified malicious domains and IPs from the Maltrail feed on 2026-02-19, which are actively being used in various campaigns to deliver malware and facilitate command and control.On 2026-02-19, the Maltrail feed identified a series of new malicious domains and IP addresses involved in suspicious network activity. This activity is likely related to ongoing campaigns aimed at delivering malware, conducting phishing attacks, or establishing command and control infrastructure. The identified domains use various techniques, including the generation of seemingly random character strings and the exploitation of coupon-related themes. The diverse naming schemes suggests a broad targeting scope rather than a single, focused campaign. Defenders should monitor and block these indicators to prevent potential compromise of their systems. Due to the nature of the Maltrail feed, specific attribution and campaign details are not available; however, proactive blocking of these indicators is crucial.

Attack Chain

  1. Initial Access: Users unknowingly visit or are redirected to malicious domains (e.g., koover.org, tributj.cyou, activebrain.conscious86jag.coupons).
  2. Redirection: The initial domain may redirect the user to other malicious sites or serve malicious content directly.
  3. Exploitation (Possible): If the user's system has unpatched vulnerabilities, the attacker may attempt to exploit them through drive-by download techniques.
  4. Malware Delivery: A malicious payload (e.g., trojan, infostealer) is delivered to the victim's system.
  5. Installation: The malware installs itself on the system, often using persistence mechanisms to ensure it runs after reboot.
  6. Command and Control: The malware establishes communication with a command and control (C2) server using IP addresses such as 144.31.238.37 and 85.137.253.64.
  7. Data Exfiltration/Malicious Activity: The attacker uses the compromised system to exfiltrate sensitive data or perform other malicious activities, such as lateral movement within the network.

Impact

A successful attack using these indicators could lead to data breaches, financial losses, and reputational damage. The wide range of domains suggests a broad targeting scope, potentially impacting numerous organizations and individuals. Compromised systems could be used to launch further attacks, spreading the malware to other victims. Given the lack of specific victimology in the source data, the potential impact is difficult to quantify, but defenders should treat these indicators as high priority.

]]>highadvisorymaltrailiocdomainipMaltrail Feed - Newly Observed Domains and IP Addresshttps://feed.craftedsignal.io/briefs/2026-02-18-maltrail-iocs/Wed, 18 Feb 2026 23:44:32 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-02-18-maltrail-iocs/This brief details newly observed network activity, specifically a list of domains and one IP address, reported by the Maltrail feed on February 18, 2026, potentially indicating emerging threats or malicious infrastructure.On February 18, 2026, the Maltrail feed reported a series of newly observed network indicators, primarily consisting of newly registered domains and a single IP address. These indicators may represent command-and-control infrastructure, phishing sites, or other malicious activities. The domains exhibit patterns suggestive of dynamically generated names, possibly to evade detection. While the exact nature of the threat is not explicitly defined in the report, the sudden appearance of these domains and the IP address warrants investigation to determine if they are associated with ongoing campaigns or emerging threats. This activity requires monitoring to assess its potential impact and prevent malicious activity.

Attack Chain

Due to the limited information available from the Maltrail feed, the complete attack chain cannot be definitively established. However, based on the types of indicators observed, a hypothetical attack chain can be constructed:

  1. Initial Compromise (Possible): A user may receive a phishing email or visit a compromised website.
  2. Redirection: The user clicks a link that redirects to one of the newly observed domains.
  3. Malware Delivery (Possible): The domain hosts malware or exploits a vulnerability on the user's system to install malware.
  4. Command and Control: The malware communicates with the IP address 212.111.89.17 to receive instructions from the attacker.
  5. Lateral Movement (Possible): The malware attempts to spread to other systems on the network.
  6. Data Exfiltration or Damage (Possible): The malware exfiltrates sensitive data or causes damage to the compromised systems.

Impact

The impact of these indicators is potentially broad, depending on the attacker's objectives. If these domains and the IP address are indeed associated with malicious activity, successful exploitation could lead to data theft, system compromise, and financial losses. The nature of the domain names suggests a possible phishing or malvertising campaign, targeting unsuspecting users. Without further analysis, it is difficult to determine the scale and scope of the potential impact.

]]>mediumadvisorymaltrailnetwork-iocdomainip-address