home.social
Sign in Create account

#keitaro — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #keitaro, aggregated by home.social.

  1. CyberVeille.ch @[email protected] ·

    📢 Doppelgänger : analyse complète de l'infrastructure d'opérations d'influence russe SDA/Structura
    📝 ## 🌐 Contexte

    Publié le 11 mai 2026 par DomainTools sur leur portail de recherche, ce rapport constitue une...
    📖 cyberveille : cyberveille.ch/posts/2026-05-1
    🌐 source : dti.domaintools.com/research/s
    #IOC #Keitaro #Cyberveille

    #cyberveille #keitaro #ioc
  2. Infoblox Threat Intel @[email protected] ·

    Keitaro series, Part 3: What happens when we zoom out from individual campaigns and examine the broader ecosystem of Keitaro abuse?

    In the third and final installment on Keitaro, we take a step back to analyze cross‑campaign trends and the Keitaro features most frequently abused at scale. We also look at cookies and cracked versions tied to threat actors like TA2726, and share what provider engagement and takedowns actually look like in practice.

    infoblox.com/blog/threat-intel

    #dns #infoblox #infobloxthreatintel #threatintel #threatintelligence #cybercrime #cybersecurity #keitaro #adtech #tds

    #dns #infoblox #infobloxthreatintel #threatintel #threatintelligence #cybercrime
  3. Infoblox Threat Intel @[email protected] ·

    Keitaro series, Part 3: What happens when we zoom out from individual campaigns and examine the broader ecosystem of Keitaro abuse?

    In the third and final installment on Keitaro, we take a step back to analyze cross‑campaign trends and the Keitaro features most frequently abused at scale. We also look at cookies and cracked versions tied to threat actors like TA2726, and share what provider engagement and takedowns actually look like in practice.

    infoblox.com/blog/threat-intel

    #dns #infoblox #infobloxthreatintel #threatintel #threatintelligence #cybercrime #cybersecurity #keitaro #adtech #tds

    #dns #infoblox #infobloxthreatintel #threatintel #threatintelligence #cybercrime
  4. Infoblox Threat Intel @[email protected] ·

    Keitaro series, Part 3: What happens when we zoom out from individual campaigns and examine the broader ecosystem of Keitaro abuse?

    In the third and final installment on Keitaro, we take a step back to analyze cross‑campaign trends and the Keitaro features most frequently abused at scale. We also look at cookies and cracked versions tied to threat actors like TA2726, and share what provider engagement and takedowns actually look like in practice.

    infoblox.com/blog/threat-intel

    #dns #infoblox #infobloxthreatintel #threatintel #threatintelligence #cybercrime #cybersecurity #keitaro #adtech #tds

    #tds #adtech #keitaro #cybersecurity #cybercrime #threatintelligence
  5. Infoblox Threat Intel @[email protected] ·

    Keitaro series, Part 3: What happens when we zoom out from individual campaigns and examine the broader ecosystem of Keitaro abuse?

    In the third and final installment on Keitaro, we take a step back to analyze cross‑campaign trends and the Keitaro features most frequently abused at scale. We also look at cookies and cracked versions tied to threat actors like TA2726, and share what provider engagement and takedowns actually look like in practice.

    infoblox.com/blog/threat-intel

    #dns #infoblox #infobloxthreatintel #threatintel #threatintelligence #cybercrime #cybersecurity #keitaro #adtech #tds

    #dns #infoblox #infobloxthreatintel #threatintel #threatintelligence #cybercrime
  6. Infoblox Threat Intel @[email protected] ·

    Keitaro series, Part 3: What happens when we zoom out from individual campaigns and examine the broader ecosystem of Keitaro abuse?

    In the third and final installment on Keitaro, we take a step back to analyze cross‑campaign trends and the Keitaro features most frequently abused at scale. We also look at cookies and cracked versions tied to threat actors like TA2726, and share what provider engagement and takedowns actually look like in practice.

    infoblox.com/blog/threat-intel

    #dns #infoblox #infobloxthreatintel #threatintel #threatintelligence #cybercrime #cybersecurity #keitaro #adtech #tds

    #dns #infoblox #infobloxthreatintel #threatintel #threatintelligence #cybercrime
  7. The Threat Codex @[email protected] ·

    No Reach, No Risk: The Keitaro Abuse in Modern Cybercrime Distribution
    #Keitaro #TilapiaParabens #TheNovosti #HircusPircus #AirportArrest
    infoblox.com/blog/threat-intel

    #keitaro #tilapiaparabens #thenovosti #hircuspircus #airportarrest
  8. The Threat Codex @[email protected] ·

    No Reach, No Risk: The Keitaro Abuse in Modern Cybercrime Distribution
    #Keitaro #TilapiaParabens #TheNovosti #HircusPircus #AirportArrest
    infoblox.com/blog/threat-intel

    #keitaro #tilapiaparabens #thenovosti #hircuspircus #airportarrest
  9. The Threat Codex @[email protected] ·

    No Reach, No Risk: The Keitaro Abuse in Modern Cybercrime Distribution
    #Keitaro #TilapiaParabens #TheNovosti #HircusPircus #AirportArrest
    infoblox.com/blog/threat-intel

    #keitaro #tilapiaparabens #thenovosti #hircuspircus #airportarrest
  10. The Threat Codex @[email protected] ·

    No Reach, No Risk: The Keitaro Abuse in Modern Cybercrime Distribution
    #Keitaro #TilapiaParabens #TheNovosti #HircusPircus #AirportArrest
    infoblox.com/blog/threat-intel

    #airportarrest #hircuspircus #thenovosti #tilapiaparabens #keitaro
  11. The Threat Codex @[email protected] ·

    No Reach, No Risk: The Keitaro Abuse in Modern Cybercrime Distribution
    #Keitaro #TilapiaParabens #TheNovosti #HircusPircus #AirportArrest
    infoblox.com/blog/threat-intel

    #keitaro #tilapiaparabens #thenovosti #hircuspircus #airportarrest
  12. The Threat Codex @[email protected] ·

    Inside Keitaro Abuse: A Persistent Stream of AI-Driven Investment Scams
    #Keitaro #FaiKast #WickedWally #FishSteaks
    infoblox.com/blog/threat-intel

    #keitaro #faikast #wickedwally #fishsteaks
  13. The Threat Codex @[email protected] ·

    Inside Keitaro Abuse: A Persistent Stream of AI-Driven Investment Scams
    #Keitaro #FaiKast #WickedWally #FishSteaks
    infoblox.com/blog/threat-intel

    #keitaro #faikast #wickedwally #fishsteaks
  14. The Threat Codex @[email protected] ·

    Inside Keitaro Abuse: A Persistent Stream of AI-Driven Investment Scams
    #Keitaro #FaiKast #WickedWally #FishSteaks
    infoblox.com/blog/threat-intel

    #keitaro #faikast #wickedwally #fishsteaks
  15. The Threat Codex @[email protected] ·

    Inside Keitaro Abuse: A Persistent Stream of AI-Driven Investment Scams
    #Keitaro #FaiKast #WickedWally #FishSteaks
    infoblox.com/blog/threat-intel

    #fishsteaks #wickedwally #faikast #keitaro
  16. The Threat Codex @[email protected] ·

    Inside Keitaro Abuse: A Persistent Stream of AI-Driven Investment Scams
    #Keitaro #FaiKast #WickedWally #FishSteaks
    infoblox.com/blog/threat-intel

    #keitaro #faikast #wickedwally #fishsteaks
  17. Infoblox Threat Intel @[email protected] ·

    We planned one report on Keitaro abuse, but we ran out of pages before we ran out of cases.
    So here’s Part 2 of 3, a medley of threats that go well beyond AI‑investment scams.

    Threat actors abuse Keitaro’s traffic distribution, cloaking, and rule engine to hide malicious landing pages behind geo and device-based filters. They stack bulletproof hosting and reverse proxies to add layers of indirection, making takedown and analysis harder. In this post, we share how we overcame this using multi‑protocol, multi‑vantage telemetry. We leveraged JA4+ web server fingerprints, DNS analytics, and Confiant’s visibility into advertising supply chain data to uncover Keitaro abuse and the delivery of malware downloaders, infostealers, weaponized RMMs, wallet drainer campaigns, scams, and email spam and advertising attack vectors.

    If you hunt threats distributed via adtech, these indicators can be useful pivots. infoblox.com/blog/threat-intel

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising #infostealer #rmm #remotemonitoringmanagement #downloader #malware #spam #airdrop #cryptocurrency #ja4 #ja4_fingerprinting

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec
  18. Infoblox Threat Intel @[email protected] ·

    We planned one report on Keitaro abuse, but we ran out of pages before we ran out of cases.
    So here’s Part 2 of 3, a medley of threats that go well beyond AI‑investment scams.

    Threat actors abuse Keitaro’s traffic distribution, cloaking, and rule engine to hide malicious landing pages behind geo and device-based filters. They stack bulletproof hosting and reverse proxies to add layers of indirection, making takedown and analysis harder. In this post, we share how we overcame this using multi‑protocol, multi‑vantage telemetry. We leveraged JA4+ web server fingerprints, DNS analytics, and Confiant’s visibility into advertising supply chain data to uncover Keitaro abuse and the delivery of malware downloaders, infostealers, weaponized RMMs, wallet drainer campaigns, scams, and email spam and advertising attack vectors.

    If you hunt threats distributed via adtech, these indicators can be useful pivots. infoblox.com/blog/threat-intel

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising #infostealer #rmm #remotemonitoringmanagement #downloader #malware #spam #airdrop #cryptocurrency #ja4 #ja4_fingerprinting

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec
  19. Infoblox Threat Intel @[email protected] ·

    We planned one report on Keitaro abuse, but we ran out of pages before we ran out of cases.
    So here’s Part 2 of 3, a medley of threats that go well beyond AI‑investment scams.

    Threat actors abuse Keitaro’s traffic distribution, cloaking, and rule engine to hide malicious landing pages behind geo and device-based filters. They stack bulletproof hosting and reverse proxies to add layers of indirection, making takedown and analysis harder. In this post, we share how we overcame this using multi‑protocol, multi‑vantage telemetry. We leveraged JA4+ web server fingerprints, DNS analytics, and Confiant’s visibility into advertising supply chain data to uncover Keitaro abuse and the delivery of malware downloaders, infostealers, weaponized RMMs, wallet drainer campaigns, scams, and email spam and advertising attack vectors.

    If you hunt threats distributed via adtech, these indicators can be useful pivots. infoblox.com/blog/threat-intel

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising #infostealer #rmm #remotemonitoringmanagement #downloader #malware #spam #airdrop #cryptocurrency #ja4 #ja4_fingerprinting

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec
  20. Infoblox Threat Intel @[email protected] ·

    We planned one report on Keitaro abuse, but we ran out of pages before we ran out of cases.
    So here’s Part 2 of 3, a medley of threats that go well beyond AI‑investment scams.

    Threat actors abuse Keitaro’s traffic distribution, cloaking, and rule engine to hide malicious landing pages behind geo and device-based filters. They stack bulletproof hosting and reverse proxies to add layers of indirection, making takedown and analysis harder. In this post, we share how we overcame this using multi‑protocol, multi‑vantage telemetry. We leveraged JA4+ web server fingerprints, DNS analytics, and Confiant’s visibility into advertising supply chain data to uncover Keitaro abuse and the delivery of malware downloaders, infostealers, weaponized RMMs, wallet drainer campaigns, scams, and email spam and advertising attack vectors.

    If you hunt threats distributed via adtech, these indicators can be useful pivots. infoblox.com/blog/threat-intel

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising #infostealer #rmm #remotemonitoringmanagement #downloader #malware #spam #airdrop #cryptocurrency #ja4 #ja4_fingerprinting

    #ja4_fingerprinting #ja4 #cryptocurrency #airdrop #spam #malware
  21. Infoblox Threat Intel @[email protected] ·

    We planned one report on Keitaro abuse, but we ran out of pages before we ran out of cases.
    So here’s Part 2 of 3, a medley of threats that go well beyond AI‑investment scams.

    Threat actors abuse Keitaro’s traffic distribution, cloaking, and rule engine to hide malicious landing pages behind geo and device-based filters. They stack bulletproof hosting and reverse proxies to add layers of indirection, making takedown and analysis harder. In this post, we share how we overcame this using multi‑protocol, multi‑vantage telemetry. We leveraged JA4+ web server fingerprints, DNS analytics, and Confiant’s visibility into advertising supply chain data to uncover Keitaro abuse and the delivery of malware downloaders, infostealers, weaponized RMMs, wallet drainer campaigns, scams, and email spam and advertising attack vectors.

    If you hunt threats distributed via adtech, these indicators can be useful pivots. infoblox.com/blog/threat-intel

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising #infostealer #rmm #remotemonitoringmanagement #downloader #malware #spam #airdrop #cryptocurrency #ja4 #ja4_fingerprinting

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec
  22. Infoblox Threat Intel @[email protected] ·

    🔴 A threat isn't much of a threat if it can't reach the right victims. 📦 That's why many modern threat actors rely on cloakers and traffic distribution systems (TDS) to target, route, and hide at scale. In a six‑month joint effort analyzing four months of data with Confiant, we identified 15,500 domains configured to Keitaro instances and actively used in cyber campaigns. Keitaro is a legitimate ad tracker, but it is frequently misused by cybercriminals as an all‑in‑one tracker + TDS + cloaker in scam and malware campaigns. We encounter Keitaro in our investigations nearly every day, and we set out to quantify that abuse in the broader landscape. We're publishing a three‑part series to share what we learned. Part 1 focuses on a subset of actors who leverage AI in their operations, most of whom are tied to investment scams. At the end of the report, you'll find a link to our github repository that contains thousands of related Keitaro iocs.

    infoblox.com/blog/threat-intel

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec
  23. Infoblox Threat Intel @[email protected] ·

    🔴 A threat isn't much of a threat if it can't reach the right victims. 📦 That's why many modern threat actors rely on cloakers and traffic distribution systems (TDS) to target, route, and hide at scale. In a six‑month joint effort analyzing four months of data with Confiant, we identified 15,500 domains configured to Keitaro instances and actively used in cyber campaigns. Keitaro is a legitimate ad tracker, but it is frequently misused by cybercriminals as an all‑in‑one tracker + TDS + cloaker in scam and malware campaigns. We encounter Keitaro in our investigations nearly every day, and we set out to quantify that abuse in the broader landscape. We're publishing a three‑part series to share what we learned. Part 1 focuses on a subset of actors who leverage AI in their operations, most of whom are tied to investment scams. At the end of the report, you'll find a link to our github repository that contains thousands of related Keitaro iocs.

    infoblox.com/blog/threat-intel

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec
  24. Infoblox Threat Intel @[email protected] ·

    🔴 A threat isn't much of a threat if it can't reach the right victims. 📦 That's why many modern threat actors rely on cloakers and traffic distribution systems (TDS) to target, route, and hide at scale. In a six‑month joint effort analyzing four months of data with Confiant, we identified 15,500 domains configured to Keitaro instances and actively used in cyber campaigns. Keitaro is a legitimate ad tracker, but it is frequently misused by cybercriminals as an all‑in‑one tracker + TDS + cloaker in scam and malware campaigns. We encounter Keitaro in our investigations nearly every day, and we set out to quantify that abuse in the broader landscape. We're publishing a three‑part series to share what we learned. Part 1 focuses on a subset of actors who leverage AI in their operations, most of whom are tied to investment scams. At the end of the report, you'll find a link to our github repository that contains thousands of related Keitaro iocs.

    infoblox.com/blog/threat-intel

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising

    #malvertising #landscape #cloaking #cloaker #trafficdistributionsystem #tds
  25. Infoblox Threat Intel @[email protected] ·

    🔴 A threat isn't much of a threat if it can't reach the right victims. 📦 That's why many modern threat actors rely on cloakers and traffic distribution systems (TDS) to target, route, and hide at scale. In a six‑month joint effort analyzing four months of data with Confiant, we identified 15,500 domains configured to Keitaro instances and actively used in cyber campaigns. Keitaro is a legitimate ad tracker, but it is frequently misused by cybercriminals as an all‑in‑one tracker + TDS + cloaker in scam and malware campaigns. We encounter Keitaro in our investigations nearly every day, and we set out to quantify that abuse in the broader landscape. We're publishing a three‑part series to share what we learned. Part 1 focuses on a subset of actors who leverage AI in their operations, most of whom are tied to investment scams. At the end of the report, you'll find a link to our github repository that contains thousands of related Keitaro iocs.

    infoblox.com/blog/threat-intel

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec
  26. Infoblox Threat Intel @[email protected] ·

    🔴 A threat isn't much of a threat if it can't reach the right victims. 📦 That's why many modern threat actors rely on cloakers and traffic distribution systems (TDS) to target, route, and hide at scale. In a six‑month joint effort analyzing four months of data with Confiant, we identified 15,500 domains configured to Keitaro instances and actively used in cyber campaigns. Keitaro is a legitimate ad tracker, but it is frequently misused by cybercriminals as an all‑in‑one tracker + TDS + cloaker in scam and malware campaigns. We encounter Keitaro in our investigations nearly every day, and we set out to quantify that abuse in the broader landscape. We're publishing a three‑part series to share what we learned. Part 1 focuses on a subset of actors who leverage AI in their operations, most of whom are tied to investment scams. At the end of the report, you'll find a link to our github repository that contains thousands of related Keitaro iocs.

    infoblox.com/blog/threat-intel

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising

    #dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec
  27. Infoblox Threat Intel @[email protected] ·

    We were alerted to a bike rental website that's been compromised by the Balada Injector campaign. The site is currently embedded with a malicious and obfuscated JavaScript that will redirect website visitors to an actor-controlled traffic distribution system (TDS) server located at

    hXXps://soft[.]specialcraftbox[.]com/JZFYbC.

    This server runs the commercial TDS management Keitaro software. The tip came from one of our employees who had started being more aware of redirects on websites after our VexTrio reporting - woot woot! The site called these domains when it triggered for the TDS on their phone:

    surprisedexpert[.]com
    iosvpnhelp[.]com
    rubestdealfinder[.]com
    slqmfq[.]top
    statisticsplatform[.]com
    plastformspecial[.]com

    Balada TDS servers typically redirect victims to fake tech support pages, fraudulent lottery wins, or push notification scams. The threat actors exploit vulnerable versions of WordPress' Popup Builder plugin, so website owners should update the plugin or disable it (if not crucial to the website's functionality). As a follow-up, the actor may have installed additional malicious plugins. Look for and disable/delete a plugin named "wp-felody.php".

    #dns #threatintel #threatintelligence #cybercrime #infosec #cybersecurity #infoblox #scam #malware #balada #tds #keitaro #javascript #injection #drivebycompromise

    here is before and after obfuscation images:

    #dns #threatintel #threatintelligence #cybercrime #infosec #cybersecurity
  28. Infoblox Threat Intel @[email protected] ·

    We were alerted to a bike rental website that's been compromised by the Balada Injector campaign. The site is currently embedded with a malicious and obfuscated JavaScript that will redirect website visitors to an actor-controlled traffic distribution system (TDS) server located at

    hXXps://soft[.]specialcraftbox[.]com/JZFYbC.

    This server runs the commercial TDS management Keitaro software. The tip came from one of our employees who had started being more aware of redirects on websites after our VexTrio reporting - woot woot! The site called these domains when it triggered for the TDS on their phone:

    surprisedexpert[.]com
    iosvpnhelp[.]com
    rubestdealfinder[.]com
    slqmfq[.]top
    statisticsplatform[.]com
    plastformspecial[.]com

    Balada TDS servers typically redirect victims to fake tech support pages, fraudulent lottery wins, or push notification scams. The threat actors exploit vulnerable versions of WordPress' Popup Builder plugin, so website owners should update the plugin or disable it (if not crucial to the website's functionality). As a follow-up, the actor may have installed additional malicious plugins. Look for and disable/delete a plugin named "wp-felody.php".

    #dns #threatintel #threatintelligence #cybercrime #infosec #cybersecurity #infoblox #scam #malware #balada #tds #keitaro #javascript #injection #drivebycompromise

    here is before and after obfuscation images:

    #dns #threatintel #threatintelligence #cybercrime #infosec #cybersecurity
  29. Infoblox Threat Intel @[email protected] ·

    We were alerted to a bike rental website that's been compromised by the Balada Injector campaign. The site is currently embedded with a malicious and obfuscated JavaScript that will redirect website visitors to an actor-controlled traffic distribution system (TDS) server located at

    hXXps://soft[.]specialcraftbox[.]com/JZFYbC.

    This server runs the commercial TDS management Keitaro software. The tip came from one of our employees who had started being more aware of redirects on websites after our VexTrio reporting - woot woot! The site called these domains when it triggered for the TDS on their phone:

    surprisedexpert[.]com
    iosvpnhelp[.]com
    rubestdealfinder[.]com
    slqmfq[.]top
    statisticsplatform[.]com
    plastformspecial[.]com

    Balada TDS servers typically redirect victims to fake tech support pages, fraudulent lottery wins, or push notification scams. The threat actors exploit vulnerable versions of WordPress' Popup Builder plugin, so website owners should update the plugin or disable it (if not crucial to the website's functionality). As a follow-up, the actor may have installed additional malicious plugins. Look for and disable/delete a plugin named "wp-felody.php".

    #dns #threatintel #threatintelligence #cybercrime #infosec #cybersecurity #infoblox #scam #malware #balada #tds #keitaro #javascript #injection #drivebycompromise

    here is before and after obfuscation images:

    #dns #threatintel #threatintelligence #cybercrime #infosec #cybersecurity
  30. Infoblox Threat Intel @[email protected] ·

    We were alerted to a bike rental website that's been compromised by the Balada Injector campaign. The site is currently embedded with a malicious and obfuscated JavaScript that will redirect website visitors to an actor-controlled traffic distribution system (TDS) server located at

    hXXps://soft[.]specialcraftbox[.]com/JZFYbC.

    This server runs the commercial TDS management Keitaro software. The tip came from one of our employees who had started being more aware of redirects on websites after our VexTrio reporting - woot woot! The site called these domains when it triggered for the TDS on their phone:

    surprisedexpert[.]com
    iosvpnhelp[.]com
    rubestdealfinder[.]com
    slqmfq[.]top
    statisticsplatform[.]com
    plastformspecial[.]com

    Balada TDS servers typically redirect victims to fake tech support pages, fraudulent lottery wins, or push notification scams. The threat actors exploit vulnerable versions of WordPress' Popup Builder plugin, so website owners should update the plugin or disable it (if not crucial to the website's functionality). As a follow-up, the actor may have installed additional malicious plugins. Look for and disable/delete a plugin named "wp-felody.php".

    #dns #threatintel #threatintelligence #cybercrime #infosec #cybersecurity #infoblox #scam #malware #balada #tds #keitaro #javascript #injection #drivebycompromise

    here is before and after obfuscation images:

    #drivebycompromise #injection #javascript #keitaro #tds #balada
  31. Infoblox Threat Intel @[email protected] ·

    We were alerted to a bike rental website that's been compromised by the Balada Injector campaign. The site is currently embedded with a malicious and obfuscated JavaScript that will redirect website visitors to an actor-controlled traffic distribution system (TDS) server located at

    hXXps://soft[.]specialcraftbox[.]com/JZFYbC.

    This server runs the commercial TDS management Keitaro software. The tip came from one of our employees who had started being more aware of redirects on websites after our VexTrio reporting - woot woot! The site called these domains when it triggered for the TDS on their phone:

    surprisedexpert[.]com
    iosvpnhelp[.]com
    rubestdealfinder[.]com
    slqmfq[.]top
    statisticsplatform[.]com
    plastformspecial[.]com

    Balada TDS servers typically redirect victims to fake tech support pages, fraudulent lottery wins, or push notification scams. The threat actors exploit vulnerable versions of WordPress' Popup Builder plugin, so website owners should update the plugin or disable it (if not crucial to the website's functionality). As a follow-up, the actor may have installed additional malicious plugins. Look for and disable/delete a plugin named "wp-felody.php".

    #dns #threatintel #threatintelligence #cybercrime #infosec #cybersecurity #infoblox #scam #malware #balada #tds #keitaro #javascript #injection #drivebycompromise

    here is before and after obfuscation images:

    #dns #threatintel #threatintelligence #cybercrime #infosec #cybersecurity
  32. ThreatCat.ch @[email protected] ·

    @rmceoin

    We're lazy so we go the easy route via URLScan.io - just enter an IP hosting such a #Keitaro TDS:

    urlscan.io/search/#ip%3A91.203

    #keitaro
  33. ThreatCat.ch @[email protected] ·

    @rmceoin

    We're lazy so we go the easy route via URLScan.io - just enter an IP hosting such a #Keitaro TDS:

    urlscan.io/search/#ip%3A91.203

    #keitaro
  34. ThreatCat.ch @[email protected] ·

    @rmceoin

    We're lazy so we go the easy route via URLScan.io - just enter an IP hosting such a #Keitaro TDS:

    urlscan.io/search/#ip%3A91.203

    #keitaro
  35. ThreatCat.ch @[email protected] ·

    @rmceoin

    We're lazy so we go the easy route via URLScan.io - just enter an IP hosting such a #Keitaro TDS:

    urlscan.io/search/#ip%3A91.203

    #keitaro
  36. ThreatCat.ch @[email protected] ·

    @rmceoin

    We're lazy so we go the easy route via URLScan.io - just enter an IP hosting such a #Keitaro TDS:

    urlscan.io/search/#ip%3A91.203

    #keitaro