Infoblox and Confiant Detail Keitaro Abuse Patterns and Provider Response
Summary
Infoblox and Confiant analyzed Keitaro abuse across DNS, email and ad telemetry, finding large-scale domain registration, conditional routing, cloaking and cookie collisions. They also detail cracked licenses and Keitaro’s response to abuse reports.
Key points
- For October 2025–January 2026, researchers recorded about 226,000 DNS queries across roughly 13,500 Keitaro-associated domains and attributed more than 8,000 new domain registrations to threat actors.
- Keitaro flows can route visitors by attributes such as location, device, operating system and browser; actors used this to direct selected users to scams while showing others decoy or benign content.
- Researchers clustered more than 120 spam campaigns abusing Keitaro; approximately 96% of the linked spam traffic promoted cryptocurrency wallet-drainer schemes.
- Cloaking used Keitaro’s filters and antibot features, custom PHP filters, and integrations with third-party services to hide malicious content from bots and reviewers.
- Researchers found that Keitaro cookie values could appear across unrelated operations, complicating attribution; they also linked some abusive instances to cracked or stolen licenses.
- After receiving more than 100 reported instance domains, Keitaro canceled over a dozen accounts; researchers observed one of the affected actors return during the review period.
Article Details
- Attack Vectors
- Keitaro-linked spam campaigns delivered malicious links and lures, including cryptocurrency wallet-drainer schemes, job fraud, and subscription phishing.
- Keitaro traffic flows conditionally redirected visitors based on geolocation, device, operating system, browser, referrer, or other visitor attributes.
- Cloaking showed benign content to bots or ad reviewers while serving malicious content to targeted visitors, using Keitaro flows, PHP filters, and third-party cloakers.
- KClient JS could contact a Keitaro campaign and replace page content without a visible redirect.
- Threat actors used bulk domain registrations and cracked or stolen Keitaro licenses to operate malicious campaigns.
- Defensive Notes
- Treat Keitaro cookie values as correlation signals rather than unique actor identifiers; the report observed collisions across unrelated operations and some stolen licenses.
- The researchers reported more than a hundred Keitaro instance domains; Keitaro canceled over a dozen accounts, and the researchers observed only one of those actors return during the review period.
- The report recommends balancing abuse reports and takedowns with security-stack measures that limit access to malicious resources, since abuse reporting is reactive and campaigns can replace domains.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | apiexplorerzone[.]com | Identified as a confirmed TA2726 domain involved in Keitaro-related activity. |
| DOMAIN | blessedwirrow[.]org | Identified as a confirmed TA2726 domain involved in Keitaro-related activity. |
| DOMAIN | digdonger[.]org | Identified as a confirmed TA2726 domain involved in Keitaro-related activity. |
| DOMAIN | fetchapiutility[.]com | Identified as a confirmed TA2726 domain involved in Keitaro-related activity. |
| DOMAIN | hmedshop[.]shop | Keitaro confirmed this domain was running outdated version 9 and associated with a cracked license. |
| DOMAIN | juxysij[.]hkjhsuies[.]com[.]es | Keitaro confirmed this domain was running outdated version 9 and associated with a cracked license. |
| DOMAIN | rapiddevapi[.]com | Identified as a confirmed TA2726 domain involved in Keitaro-related activity. |
| DOMAIN | rednosehorse[.]com | Identified as a confirmed TA2726 domain involved in Keitaro-related activity. |
| DOMAIN | ryptosell[.]shop | Hosted a crypto scam page impersonating MAJOR crypto. |
| DOMAIN | scyphoserippleepidosite[.]com | Landing-page domain routed from subiz[.]tds11111[.]com in the reported campaign. |
| DOMAIN | subiz[.]tds11111[.]com | Associated with a fake search page indicating a malicious file download. |
| DOMAIN | sunpetalra[.]com | Used in a fake Russian government social-dividend scam. |
| DOMAIN | swim39[.]ru | Keitaro confirmed this domain was running outdated version 9 and associated with a cracked license. |
| DOMAIN | tonamlchecks[.]com | Associated with a scam page presenting a fake tool for analyzing TON blockchain transactions. |
| IPV4 | 185[.]184[.]123[.]58 | Dedicated TA2726 IP address; the report notes it is inactive. |
| IPV4 | 62[.]60[.]246[.]29 | IP address previously hosting crypto scams. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationCloaking through Keitaro flows and filters served benign pages to bots or reviewers while reserving malicious pages for targeted visitors.T1059.007 · JavaScriptKClient JS scripts inserted into external pages contacted Keitaro campaigns and could replace page content without a visible redirect.T1566 · PhishingKeitaro-linked spam campaigns delivered malicious links and lures, including cryptocurrency wallet-drainer schemes and subscription phishing.T1583 · Acquire InfrastructureThe report attributed over 8,000 new domain registrations to threat actors using Keitaro for campaigns and traffic distribution.
People
Threat Actors
Storm-0569The article cites reporting that Keitaro acknowledged some threat actors, including Storm-0569, used cracked versions of the product for malicious activity.TA2726The report identifies TA2726 as a traffic broker distributing SocGholish and other malware through Keitaro-related traffic distribution operations. The researchers believe it uses cracked or stolen Keitaro version 11 licenses.TA576The researchers believe TA576 uses cracked or otherwise stolen Keitaro version 11 licenses.
Malware
DarkGateFor example, in reporting on fake browser updates, the autoIT loader, and DarkGate spread of remote access trojans.SocGholishvisitors and redirects them to attacker-controlled fake update pages or other payload deliveries (e.g., SocGholish, or ISO loaders), rather than relying on KClient JS.
Vendors
Products
Tools
Adspect CloakerOther cloaking kits offer variations of the same features, including the more premium Adspect Cloaker, which boasts AI-enabled traffic filtering capabilities and the ability to circumvent detections by major platformsHideClickwas implemented via Keitaro flows, custom PHP filters, and thirdâparty cloaker integrations (e.g., HideClick, Adspect), allowing benign content for bots/reviewers while serving malicious payloads to targeted users.IMKLOFor several years, Keitaro offered direct integrations with third-party cloaking software, such as IMKLO, and even advertised cloaking as a feature early on in their company history.
Countries
GermanyNearly all web visitors that matched the targeting rules fell into one of two cohorts: Android users in Germany and Windows PC users in the United States or Switzerland.SwitzerlandNearly all web visitors that matched the targeting rules fell into one of two cohorts: Android users in Germany and Windows PC users in the United States or Switzerland.United StatesNearly all web visitors that matched the targeting rules fell into one of two cohorts: Android users in Germany and Windows PC users in the United States or Switzerland.
Industries
CryptocurrencyKeitaro-linked spam was prolific: ~96% of Keitaro-linked spam promoted cryptocurrency walletâdrainer schemes (AURA, SOL, Phantom, Jupiter), plus other lures like job fraud and subscription phishing acrossdigital advertisingUsing Confiant’s visibility into digital advertising supply chains, we analyzed 275 million ad impressions delivered via supply paths impacting premium publishers over the observation window.