Infoblox Details How Cybercriminals Abuse Keitaro to Scale Malicious Campaigns
Summary
A four-month Infoblox–Confiant study finds threat actors use Keitaro’s tracker, cloaker and traffic-distribution features to scale scams, phishing and malware delivery; it documents wallet-drainer spam, malware hosting and domain-hijacking activity.
Key points
- More than 20% of threat actors tracked by Confiant used Keitaro during the study period; some campaigns generated tens of millions of impressions.
- About 96% of spam emails linking to Keitaro instances led to cryptocurrency wallet-drainer scams, according to the study.
- JA4+ fingerprinting identified more than 100 IP addresses associated with malware distribution and exposed Keitaro admin consoles.
- Researchers observed DonutLoader injecting StealC v2 into Chrome and Edge processes; the stealer targeted browser data and cryptocurrency wallet files.
- Campaigns also used hash-busting to vary phishing email content and evade simple signature-based spam rules.
- The report describes domain hijacking through DNS lame delegation, a technique associated with Sitting Ducks activity.
- Keitaro’s owner responded to abuse reports, but stolen licenses and large volumes of disposable domains complicate takedowns.
Article Details
- Publisher
- Infoblox, with Confiant
- Report Period
- Four-month study; exact study dates not stated.
- Scope
- Keitaro abuse for scams, phishing, malvertising, malware distribution, and related cloaking and traffic routing.
- Sample Size
- 25 spam actors; approximately 120 campaigns; tens of thousands of emails; over 100 IP addresses associated with malware distribution.
- Key Statistics
- Over 20% of threat actors tracked by Confiant during the study period used Keitaro.
- Approximately 96% of spam emails linking to Keitaro instances led to cryptocurrency wallet-drainer scams, according to the report.
- During the four-month period, 25 actors conducted approximately 120 spam campaigns and sent tens of thousands of emails.
- JA4+ fingerprinting identified over 100 IP addresses associated with malware distribution.
- Eight of the approximately 30 malvertising actors Confiant typically tracks with high-confidence attribution were identified as using Keitaro during the report's date range.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | azgrvfra[.]com | Domain used by an actor in investment-scam pages impersonating legitimate businesses. |
| DOMAIN | bmosecure-portal[.]app | Lookalike domain listed among phishing domains impersonating Canadian financial institutions. |
| DOMAIN | canadapostshipment[.]info | Lookalike domain listed among domains used by an unnamed actor to impersonate businesses in phishing pages. |
| DOMAIN | cibcsecurity2fa[.]com | Lookalike domain used by an unnamed actor to impersonate a Canadian financial institution in phishing. |
| DOMAIN | cooldece[.]com | Fraudulent website used in a Phantom giveaway scam to lure victims toward a wallet drainer. |
| DOMAIN | digitalwealth-au[.]com | Domain used in an investment scam whose page content impersonated legitimate businesses. |
| DOMAIN | fedexca-orderstatus[.]link | Lookalike domain listed among domains used to impersonate businesses and logistics services. |
| DOMAIN | fitness-zenew[.]info | Sample domain associated with an unnamed actor's healthcare-product scam shops. |
| DOMAIN | health[.]tenerium[.]org | Domain identified as hosting a health scam. |
| DOMAIN | holzveredler247[.]com | AirportArrest landing-page domain used in an investment scam impersonating a legitimate news article. |
| DOMAIN | hotelbiloxi[.]com | AirportArrest investment-scam landing-page domain used with fake-arrest clickbait. |
| DOMAIN | interac-gigadat15[.]info | Lookalike domain shown as an example of phishing content impersonating Canadian financial institutions and services. |
| DOMAIN | investarmco[.]com | Domain used by HircusPircus for a high-volume investment scam campaign with Keitaro cloaking. |
| DOMAIN | leadshub[.]trk-links[.]com | TDS-style domain used in redirect chains routing users to gambling pages. |
| DOMAIN | meetdatefind[.]com | TDS domain used to route hijacked domains toward adult-content pages in an actor's campaign. |
| DOMAIN | object[.]brovanti[.]com | Attacker-controlled ScreenConnect control portal served from a host used to deploy RMM software to victims. |
| DOMAIN | petalsage[.]com | AirportArrest landing-page domain used for a cloaked investment scam with a fake story. |
| DOMAIN | promoswf[.]shop | Domain listed among TilapiaParabens rewards-scam campaign indicators. |
| DOMAIN | rbcsecurityservices[.]com | Lookalike domain used by an unnamed actor in phishing pages impersonating Canadian financial institutions. |
| DOMAIN | terrainane[.]com | TheNovosti clickbait domain used to lead victims into malvertising chains. |
| DOMAIN | top9mediatrk[.]com | TDS-style routing domain observed in a redirect chain associated with health-product scam pages. |
| DOMAIN | trending-now[.]today | Sample domain associated with an unnamed actor's healthcare-product scam shops. |
| IPV4 | 158[.]94[.]208[.]165 | Passive DNS identified this as the real IP address for honknft[.]com, used in a wallet-draining scam. |
| IPV4 | 158[.]94[.]209[.]29 | Mail server used in a localized spam campaign and previously linked to Remcos RAT C2 infrastructure. |
| IPV4 | 62[.]60[.]226[.]248 | Host associated with a Keitaro admin console that hosted and distributed DonutLoader malware. |
| SHA256 | b98b53ca03e3e9009b31bcc37b90b206064b25effce449dde63c51cef6a47470 | SHA-256 hash of the DonutLoader malware payload hosted on 62[.]60[.]226[.]248. |
| URL | hxxp[:]//62[.]60[.]178[.]163/ce369e7324834845[.]php | StealC v2 C2 endpoint configured to receive stolen data. |
| URL | hxxps[:]//estrategicadesenvolvimento[.]com[.]br/Webmail/webmail[.]php?email={victim@email} | Dynamically crafted phishing link used in localized spam to send victims to a fraudulent webmail login page. |
| URL | hxxps[:]//honknft[.]com/connect/rh7_1a7r72zi-kk4k4z?b=1 | Wallet-drainer redirect that instructed victims to connect a Phantom wallet and sign a malicious transaction. |
| URL | hxxps[:]//membros[.]mtcreatingimages[.]com/spotify | Phishing URL linked in emails impersonating Spotify and claiming the victim's payment method had failed. |
MITRE ATT&CK
T1071.001 · Web ProtocolsStealC v2 used an HTTP endpoint for C2 communications and exfiltration of stolen data.T1105 · Ingress Tool TransferKeitaro-hosted sites served malware payloads and installers, including loaders and RMM agents.T1219 · Remote Access ToolsScreenConnect was deployed to auto-enroll victims into actor-controlled network relays.T1564 · Hide ArtifactsKeitaro and cloaking kits conditionally served landing pages to conceal malicious content and evade platform defenses.T1566 · PhishingKeitaro-gated spam campaigns routed victims to phishing pages and cryptocurrency wallet drainers.
Threat Actors
AirportArrestThe report describes AirportArrest as an actor behind cloaked investment scams in multiple countries, using fake-arrest content as clickbait.HircusPircusThe report describes HircusPircus as an international scam group advertising fraudulent investment opportunities; it used Keitaro with the HideClick cloaking kit in a campaign hosted on investarmco[.]com.TheNovostiThe report describes TheNovosti as an Eastern European-origin actor running large-scale cloaked campaigns involving malicious push notifications and malvertising; it used Keitaro for cloaking.
Malware
DonutLoaderThe report highlights largeâscale abuse examples including DonutLoader/StealCâbased malware delivery, extensive spam-to-phish walletâdrainer campaigns, and highâvolume cloaked ad fraud.Remcos RAT[IP address ] malware hosting / Keitaro admin portals – 62[.]60[.]226[.]248 (DonutLoader/Keitaro admin exposed), 158[.]94[.]209[.]29 (mail server tied to localized spam; previously linked to Remcos RAT C2)RustyStealerActors use Keitaro for diverse abuse: infoâstealers and loaders (DonutLoader, StealC v2, RustyStealer), RMM/ScreenConnect deployments, lookalike domain phishing, PII harvesting (TilapiaParabens), and geoâgatedStealC v2Actors use Keitaro for diverse abuse: infoâstealers and loaders (DonutLoader, StealC v2, RustyStealer), RMM/ScreenConnect deployments, lookalike domain phishing, PII harvesting (TilapiaParabens), and geoâgated
Vendors
ApliteniDespite responsive abuse reporting from Keitaro’s owner (Apliteni), stolen licenses and the high volume of disposable domains hinder largeâscale takedowns and attribution.CloudflareThe majority of observed Keitaro instances are operated by actors with ties to Eastern Europe, frequently fronted by Cloudflare or hosted in bulletproof providers.ConnectWise[T1219] Remote Access Software – Adversaries deployed ScreenConnect/ConnectWise Control to autoâenroll victims into attacker-controlled RMM: ‘ScreenConnect that auto-enrolled victims into the actor-controlled networkFEMO IT SOLUTIONS LIMITEDJA4+ fingerprinting uncovered Keitaro admin consoles and over 100 IPs linked to malware distribution, notably an AS (AS214351 / FEMO IT SOLUTIONS LIMITED) hosting DonutLoader and other payloads.
Products
ConnectWise ScreenConnect[T1219] Remote Access Software – Adversaries deployed ScreenConnect/ConnectWise Control to autoâenroll victims into attacker-controlled RMM: ‘ScreenConnect that auto-enrolled victims into the actor-controlled networkGoogle ChromeIn the attack that we observed, the DonutLoader injected the StealC v2 information stealer into Chrome and Microsoft Edge browser processes.Keitaro TrackerKeitaro is widely abused as an allâinâone adtech tracker, cloaker, and TDS by diverse threat actors to scale scams, phishing, malvertising, and malware distribution while outsourcing targeting and routing.Microsoft EdgeIn the attack that we observed, the DonutLoader injected the StealC v2 information stealer into Chrome and Microsoft Edge browser processes.Phantom[Domain ] scam, phishing, and Keitaro instances – honknft[.]com (walletâdrainer redirect / Phantom impersonation), investarmco[.]com (HircusPircus investment scam), and 40+ other malicious or lookalike domainsScreenConnectKeitaro for diverse abuse: infoâstealers and loaders (DonutLoader, StealC v2, RustyStealer), RMM/ScreenConnect deployments, lookalike domain phishing, PII harvesting (TilapiaParabens), and geoâgated gambling
Tools
CloakilioThey typically use local cloaking kits such as The White Rabbit and Cloakilio, but the dataset that was in scope for this report showed multiple instances of Keitaro used for cloaking as well.HideClickHowever, we did observe them running Keitaro with the HideClick cloaking kit enabled in a prominent, high-volume campaign (hosted on investarmco[.]com) at the end of October 2025.JA4+JA4+ fingerprinting uncovered Keitaro admin consoles and over 100 IPs linked to malware distribution, notably an AS (AS214351 / FEMO IT SOLUTIONS LIMITED) hosting DonutLoader and other payloads.The White RabbitThey typically use local cloaking kits such as The White Rabbit and Cloakilio, but the dataset that was in scope for this report showed multiple instances of Keitaro used for cloaking as well.
Countries
CanadaIn parallel, they also spoof the branding of shipping and logistics companies (DHL, FedEx, Canada Post) as well as government and retail services such as Costco.ItalyAirportArrest is an actor behind cloaked investment scams that span multiple countries including Canada, Italy, Switzerland, and others.RussiaDomain registration details and hosting history for honknft[.]com indicate the actor is likely based in Russia.SwitzerlandAirportArrest is an actor behind cloaked investment scams that span multiple countries including Canada, Italy, Switzerland, and others.
Industries
advertisingRecently we published the first part of a four-month-long study conducted with Confiant on the abuse of Keitaro, an advertising performance tracker frequently abused by threat actors.CryptocurrencySpam remains a primary vector: ~96% of spam emails linking to Keitaro led victims to cryptocurrency wallet drainers in hybrid phishing/drainer flows.HealthcareDubious healthcare products are a problem that predates the digital era.online gamblingHowever, this activity, including online gambling, is typically not standalone and is instead part of larger, coordinated scam operations.