{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/ip/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["maltrail","ioc","domain","ip"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eOn 2026-02-19, the Maltrail feed identified a series of new malicious domains and IP addresses involved in suspicious network activity. This activity is likely related to ongoing campaigns aimed at delivering malware, conducting phishing attacks, or establishing command and control infrastructure. The identified domains use various techniques, including the generation of seemingly random character strings and the exploitation of coupon-related themes. The diverse naming schemes suggests a broad targeting scope rather than a single, focused campaign. Defenders should monitor and block these indicators to prevent potential compromise of their systems. Due to the nature of the Maltrail feed, specific attribution and campaign details are not available; however, proactive blocking of these indicators is crucial.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access:\u003c/strong\u003e Users unknowingly visit or are redirected to malicious domains (e.g., koover.org, tributj.cyou, activebrain.conscious86jag.coupons).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRedirection:\u003c/strong\u003e The initial domain may redirect the user to other malicious sites or serve malicious content directly.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExploitation (Possible):\u003c/strong\u003e If the user's system has unpatched vulnerabilities, the attacker may attempt to exploit them through drive-by download techniques.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMalware Delivery:\u003c/strong\u003e A malicious payload (e.g., trojan, infostealer) is delivered to the victim's system.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInstallation:\u003c/strong\u003e The malware installs itself on the system, often using persistence mechanisms to ensure it runs after reboot.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCommand and Control:\u003c/strong\u003e The malware establishes communication with a command and control (C2) server using IP addresses such as 144.31.238.37 and 85.137.253.64.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eData Exfiltration/Malicious Activity:\u003c/strong\u003e The attacker uses the compromised system to exfiltrate sensitive data or perform other malicious activities, such as lateral movement within the network.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA successful attack using these indicators could lead to data breaches, financial losses, and reputational damage. The wide range of domains suggests a broad targeting scope, potentially impacting numerous organizations and individuals. Compromised systems could be used to launch further attacks, spreading the malware to other victims. Given the lack of specific victimology in the source data, the potential impact is difficult to quantify, but defenders should treat these indicators as high priority.\u003c/p\u003e\n","date_modified":"2026-02-19T16:36:58Z","date_published":"2026-02-19T16:36:58Z","id":"https://feed.craftedsignal.io/briefs/2026-02-19-maltrail-iocs/","summary":"This brief covers newly identified malicious domains and IPs from the Maltrail feed on 2026-02-19, which are actively being used in various campaigns to deliver malware and facilitate command and control.","title":"Maltrail Feed IOCs Targeting Multiple Verticals","url":"https://feed.craftedsignal.io/briefs/2026-02-19-maltrail-iocs/"}],"language":"en","title":"CraftedSignal Threat Feed - Ip","version":"https://jsonfeed.org/version/1.1"}