MalwarePublished 19 Feb 2026

tlp clear · Maltrail IOC for 2026-02-19

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Description

This entry describes a Maltrail Indicator of Compromise (IOC) dated February 19, 2026, categorized as malware with a medium risk level. The information is sourced from the CIRCL OSINT feed and is labeled as an unsupervised, manual collection of network activity observations. No specific affected versions, exploits in the wild, or patches are noted, and no detailed technical indicators or vulnerabilities are provided. The threat is primarily an OSINT observation without concrete actionable details or known active exploitation. Given the lack of detailed technical data, the threat appears to be of medium severity, reflecting potential but unconfirmed risk. Organizations should remain vigilant for related network anomalies but no immediate critical action is mandated. The threat's global impact is uncertain due to the absence of affected products or sectors. Countries with significant use of network monitoring tools and high cyber threat exposure may be more attentive to such IOC feeds. Overall, this represents a medium-level malware-related network activity observation without direct exploit evidence.

Impact

Given the lack of specific affected products, exploit details, or active attacks, the direct impact of this IOC is limited. However, it signals the presence or detection of suspicious network activity that could indicate malware infections or reconnaissance attempts within monitored networks. Organizations relying on network traffic analysis tools like Maltrail may use this IOC to enhance their detection capabilities and identify potential compromises early. The medium severity suggests a moderate risk of confidentiality or integrity breaches if the underlying malware is active, but no immediate widespread disruption or critical system compromise is indicated. The absence of known exploits reduces the urgency, but the potential for undetected malware presence means organizations should maintain vigilance. The impact is primarily on network security monitoring and incident response readiness rather than direct operational disruption or data loss at this stage.

Defensive guidance

Organizations should integrate this IOC into their existing network monitoring and intrusion detection systems, particularly if using Maltrail or similar tools, to improve detection of suspicious traffic patterns. Regularly update threat intelligence feeds and correlate this IOC with internal logs to identify any matching network activity. Conduct thorough network traffic analysis and endpoint investigations if suspicious indicators arise. Enhance network segmentation and restrict unnecessary outbound connections to limit malware communication channels. Employ behavioral analytics to detect anomalies beyond signature-based detection. Maintain updated endpoint protection and conduct regular vulnerability assessments to reduce infection vectors. Since no patches are available, focus on detection, containment, and response capabilities. Share findings with relevant cybersecurity communities to enrich collective threat awareness. Finally, ensure incident response teams are prepared to investigate and remediate potential malware infections indicated by such IOCs.

Summary

The provided information pertains to a Maltrail IOC dated February 19, 2026, sourced from the CIRCL OSINT feed. Maltrail is a network traffic detection system that identifies suspicious or malicious network activity by monitoring traffic and comparing it against known indicators of compromise. This IOC is classified as malware-related with a medium threat level but lacks detailed technical indicators such as specific malware signatures, affected software versions, or exploit mechanisms. The data is tagged as an unsupervised manual collection, indicating it was gathered through open-source intelligence methods rather than automated detection or confirmed incident response. No patches or mitigations are available, and no known exploits in the wild have been reported. The absence of CWE identifiers and technical details limits the ability to analyze the exact nature of the malware or its attack vectors. The IOC serves primarily as an alert or observation to network defenders to be aware of potential malicious network activity patterns detected by Maltrail systems. The timestamp and UUID provide tracking references but do not add technical context. Overall, this is an intelligence feed entry highlighting potential malware-related network activity without concrete exploit or vulnerability data.

Indicators of compromise

Domains 208

koover.org
tributj.cyou
activebrain.conscious86jag.coupons
allu7eho1a.ru
censure47contr.coupons
checknode.censure47contr.coupons
conscious86jag.coupons
magicbook.overdue13wizard.coupons
magiclook.allu7eho1a.ru
mentalpulse.conscious86jag.coupons

URLs 58

https://api.github.com/repos/stamparm/maltrail/commits/11b8e64ee8f1179d3a57ed9d6acb04b6db98685f
https://api.github.com/repos/stamparm/maltrail/commits/1abcb0daf207436d840b79aa6a03dae8685b06dc
https://api.github.com/repos/stamparm/maltrail/commits/32a76ddc120c0277d847fbcbc9288d61621c6ada
https://api.github.com/repos/stamparm/maltrail/commits/891b85778a0dca163aab9a0357d4ad0070f1dde7
https://www.virustotal.com/gui/ip-address/172.86.68.175/relations
https://api.github.com/repos/stamparm/maltrail/commits/38a0e5323dfab3c52d49e9a5ebc378a77613c2e4
https://www.malware-traffic-analysis.net/2026/02/02/index.html
https://api.github.com/repos/stamparm/maltrail/commits/161165f924c2d4f0f724c560e8a61be490c2a32f
https://api.github.com/repos/stamparm/maltrail/commits/cad8eeb78d9aaff26917877b09d8299c53d45955
https://www.linkedin.com/posts/any-run_moonrise-anyrun-anyrun-activity-7429889782744338432-m2TU

IP addresses 6

144.31.238.37
85.137.253.64
193.23.199.88
206.123.132.160
185.208.159.245
158.94.210.166

Community reviews

Loading reviews…