DNS and WHOIS Analysis Maps Infrastructure Linked to Keenadu Android Backdoor

Apr 15, 2026 · Original article ↗

Summary

Researchers analyzed 29 DNS and WHOIS indicators linked to the Keenadu Android firmware backdoor, finding related domains and IPs. Traffic data showed 339 client IPs contacting three indicator domains and 61 potential victim IPs contacting two indicator IPs.

Key points

Researchers believe Keenadu entered Android firmware through a malicious static library linked to libandroid_runtime.so during builds or through compromised firmware delivered in OTA updates.
The multistage loader reportedly enables remote device control and payloads for search hijacking, monetized app installs, and stealthy ad interactions.
The DNS and WHOIS analysis covered 29 primary indicators: five subdomains, 20 domains, and four IP addresses.
Network data showed 339 client IP addresses communicating with three indicator domains and 61 potential victim IP addresses communicating with two indicator IPs; these observations do not independently confirm infection.
Researchers identified 80 email-connected domains, 12 of which were flagged as malicious, and eight additional IP addresses, four of which had been associated with malicious campaigns.
The researchers caution that some flagged entities may later be reclassified and recommend supplementary investigation.

Article Details

Attack Vectors: Researchers believe Keenadu was introduced into some Android firmware through a malicious static library linked to libandroid_runtime.so during firmware builds.
In other cases, compromised firmware containing Keenadu was delivered through OTA updates.
Defensive Notes: The article recommends supplementary investigation to corroborate entities flagged as malicious, noting that some may later be reclassified.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`dllpgd[.]click`	Domain IoC identified in the analysis and reported as likely to turn malicious before its February 2026 identification.
DOMAIN	`fbgraph[.]com`	Listed as a domain IoC in the analysis of infrastructure associated with Keenadu.
DOMAIN	`fuhidd[.]com`	Email-connected domain reported as weaponized for malware distribution.
DOMAIN	`gsonx[.]com`	Listed as a domain IoC in the analysis of infrastructure associated with Keenadu.
DOMAIN	`gvvt1[.]com`	Domain IoC identified in the analysis and reported as likely to turn malicious before its February 2026 identification.
DOMAIN	`huulog[.]com`	Email-connected domain reported as weaponized for malware distribution.
DOMAIN	`huuww[.]com`	Email-connected domain reported as weaponized for malware distribution.
DOMAIN	`istaticfiles[.]com`	Reported as a host for Keenadu-related IoC subdomains and as a domain that appears to have been registered to host malicious content.
DOMAIN	`keepgo123[.]com`	Listed as a domain IoC in the analysis of infrastructure associated with Keenadu.
DOMAIN	`mtcpmpm[.]com`	Email-connected domain reported as weaponized for malware distribution.
DOMAIN	`mtcprogram[.]com`	Email-connected domain reported as weaponized for malware distribution.
DOMAIN	`playstations[.]click`	Domain IoC identified in the analysis and reported as likely to turn malicious before its February 2026 identification.
DOMAIN	`proczone[.]com`	Listed as a domain IoC in the analysis of infrastructure associated with Keenadu.
IPV4	`104[.]21[.]87[.]166`	Additional IP address reported as having appeared in malicious campaigns involving malware distribution and phishing.
IPV4	`110[.]34[.]191[.]81`	IP address identified as a Keenadu-related IoC; the article reports potential victim IPs communicating with IoC IPs.
IPV4	`172[.]67[.]144[.]175`	Additional IP address reported as having appeared in malicious campaigns involving malware distribution and phishing.
IPV4	`67[.]198[.]232[.]187`	IP address identified as a Keenadu-related IoC; the article reports potential victim IPs communicating with IoC IPs.