ScamIntelLogs

Keitaro TDS

Traffic Distribution System Detection Toolkit

Cloaking Detection 50,000+ Sites Scanned Non-invasive
0
Admin Panels Found
7
Detection Methods
0
Legitimate Uses Found
Online Tool
Keitaro TDS Checker
Scan any domain — 7 evidence checks, instant results, no installation

Disclaimer

We are not claiming all Keitaro users are criminals. However, despite extensive research, we have found no legitimate use cases. Every instance involves malware, phishing, scams, or ad fraud.

Our tools are non-invasive. They only use publicly documented Keitaro API endpoints. No exploitation, no attacks — just detection.

What is Keitaro TDS?

A Traffic Distribution System designed to show different content to different visitors. In practice, moderators see legitimate content while victims see malicious pages: crypto scams, phishing, malware downloads, fake shops. This is "cloaking" — it exists solely to deceive security systems.

Crypto drainers
Phishing
Malware
Fake shops
Romance scams
Gambling

7-Point Detection

E5Click API — /click_api/v3
E6Offer Reaction — _lp + _token
E7Update Tokens — _update_tokens=1
E1Offer URL params
E3Subid Cookie
E4HTML Markers — KTracking, {subid}, {offer}
E2Landing Params — _subid + _token

Verdict: 2+ evidences = KEITARO CONFIRMED

🔎
Online Checker
Browser-based TDS detector
🐍
Python Script
keitaro_hunter_4.py
📊
Panels Database
1,565+ panels with IPs

Quick Start

# Install
pip install httpx faker rich
# Single scan
python keitaro_hunter_4.py suspicious-site.com
# Mass scan
python keitaro_hunter_4.py domains.txt -w 100 -o results.json
Satire based on documented facts

A Letter from Keitaro*

* Satirical commentary on publicly documented facts. Every claim is sourced. Keitaro did not write this — we did, based on their own documentation, court records, and security research.

"Dear valued partners and friends of the ecosystem. We at Apliteni OU, operating as Keitaro from our prestigious office at Sepapaja tn 6, Tallinn, Estonia, would like to share our pride in our achievements and clientele."

🏆 We Are Proud of Our Clients

"At Keitaro, we have always attracted the most ambitious operators in their respective fields:"

EvilCorp / Water Scylla
Operators of SocGholish utilize Keitaro TDS to distribute malware including VIPERTUNNEL backdoors
LockBit Ransomware
SocGholish malware spread via Keitaro delivers initial access to LockBit ransomware operators
DEV-0569 / Storm-0569
Microsoft documented this threat actor using Keitaro in malvertising campaigns to deploy Royal ransomware
VexTrio (60+ affiliates, 70k domains)
Massive cybercrime affiliate program using Keitaro premium for traffic distribution
TA569 / SocGholish / FakeUpdates
Fake browser updates. Functions as Initial Access Broker for ransomware gangs
ClearFake
Runs Keitaro on C2 servers to protect infra and filter traffic. Uses premium version
FakeBat / Eugenfest
Loader-as-a-Service ($1k-$5k/mo) distributing IcedID, Lumma, RedLine, SmokeLoader
Doppelganger (Russian disinfo)
"Largest Russian-origin disinformation operation" — Keitaro for targeting propaganda to EU
RIG EK Nuclear EK Fallout EK IcedID Lumma RedLine SmokeLoader Royal Ransomware RansomHub Amadey Ursnif SectopRAT VIPERTUNNEL

🛠 We Help Our Clients Control Their Infrastructure

"We always strive to help our valued clients maintain uninterrupted operations. Because nothing ruins a good phishing campaign like getting banned:"

20+ Traffic Filters for Cloaking
Geolocation, mobile carrier, device, browser, OS, timetable — show clean pages to moderators, malicious pages to victims
Sandbox Detection & AV Bypass
Filter out security sandboxing IPs. Integrated AV checkers (Viruscheckmate, AVscan) that don't share samples with the AV industry
Unblockable by Design
"Because Keitaro also has many legitimate applications, it is frequently difficult or impossible to simply block traffic through the service"

💰 The Most Expensive Cloaking Tool on the Market

"Why do we cost more than all competitors? Because our features are specifically designed for one audience, and they know exactly what they're paying for."

Starter
€40
/month
1 user, 1 domain
Advanced
€72
/month
1 user, 100 domains
Expert
€104
/month
5 users, 500 domains
Team
€200
/month
50 users, 5k domains
Enterprise
€400
/month
Unlimited, branding
What exactly are you paying €40-400/month for?
Keitaro "Features":
  • "Integration Facebook" — a.k.a Facebook Pixel (free)
  • "Integration Google Ads" — a.k.a Google Tag Manager (free)
  • "Integration TikTok" — a.k.a TikTok Pixel (free)
  • "Integration Cloudflare" — Cloudflare DNS (free)
  • "Integration Namecheap" — domain registrar API (free)
  • "Tracking scripts" — Google Analytics (free)
  • "Landing page editor" — any CMS (free)
The REAL reason it costs €400/mo:
  • Bypass Google Ads moderation
  • Bypass Facebook moderation
  • Hide from antivirus systems
  • Evade security sandboxes
  • Cloak malicious content
  • Built-in AV checker integration
  • 20+ filters for targeted deception

All "features" on the left are available for free from Google, Facebook, TikTok, and Cloudflare. No legitimate marketer pays €40-400/month for things they get free. The price is for the cloaking engine on the right.

More Expensive Than All Competitors
€40-400
Keitaro
$69
Binom
$119
Voluum

Binom and Voluum are legitimate ad trackers. They don't have 20+ cloaking filters, AV checker integration, or a client base of documented threat actors. Keitaro costs more because it's optimized for a specific type of client who understands what they're paying for.

Real Self-Hosted & Open-Source Analytics: $0

These are real products. Open-source. Actually self-hosted. No license server. No telemetry. No ClickUp. No surveillance.

What real self-hosted means:
  • Source code on GitHub — audit everything
  • No license server phoning home
  • No telemetry, no data exfiltration
  • No ClickUp, no AWS, no third-party SaaS
  • No remote license revocation
  • Your server, your code, your data — for real
Keitaro's "self-hosted" (€40-400/mo):
  • Closed-source — no audit possible
  • License server tracks every deployment
  • Telemetry sends data to Apliteni
  • ClickUp integration = data on AWS
  • Remote license revocation (proven)
  • Cost: up to €4,800/year

Five open-source tools above do everything a legitimate marketer needs — for $0. Keitaro charges €40-400/month to run on your server while streaming your data to their infrastructure. That's not self-hosting — that's surveillance as a service. The price isn't for analytics. It's for the dark interface: cloaking, sandbox detection, AV bypass.

Not an Accomplice — They ARE the Infrastructure

Keitaro is not a tool that criminals happen to use. Keitaro IS the criminal infrastructure. Every cloaked page, every bypassed moderation check, every malware download — it runs through Keitaro's TDS engine, tracked by Keitaro's license server, stored at Keitaro's ClickUp workspace, hosted on Keitaro's partner AWS.

Real self-hosted trackers exist for free. Open-source, no phone-home, no telemetry, no SaaS dependency. The fact that criminals pay €40 to €400 per month for Keitaro instead proves it: the product isn't a tracker. The product is the cloaking infrastructure itself — the moderation bypass engine, the sandbox detector, the AV evasion checker. Without Keitaro, these campaigns don't work.

When you build, sell, and maintain the infrastructure that makes crime possible — you're not a bystander. You're not an accomplice. You are the infrastructure. Especially when you charge premium prices for it.

Why Are We "Legal"? Great Question

Estonian Shell Company
Registered as Apliteni OU in Tallinn. Also in Delaware, USA. CEO previously lived in Russia (now Spain). At least 7 employees based in Russia per LinkedIn.
0% Legitimate Use Cases
If your product serves a legitimate purpose, your users would use Google Tag Manager, Facebook Pixel, or any of dozens of free tools. Instead, your client list reads like a Europol most-wanted report. Any brand doing legal marketing would use free tools — nobody pays €400/mo for something Google gives away.

😂 "Self-Hosted!" — Your Data Is at ClickUp (Amazon)

"We love telling everyone we're self-hosted. It sounds so private! Let's read our own documentation..."

From Keitaro's Own Documentation:
  • Click data retention: default 256 days, configurable up to 3,560 days (~9.75 years)
  • Setting retention to 0 = statistics never deleted
  • Stores: all clicks, cookies, subids, offers, landing pages, visitor data
  • Data can be transferred upon request
Keitaro 10+ — We See Everything. We Collect Everything.

Keitaro 10+ introduced ClickUp integration. ClickUp runs on Amazon Web Services (AWS). Here is what this means for your "self-hosted" data:

  • 1. Your database is at ClickUp — every click, every visitor fingerprint, every conversion, every subid, every redirect chain flows through ClickUp's AWS infrastructure
  • 2. ClickUp stores data for years — running on AWS, their retention policies comply with US law. Data persists long after you delete it from Keitaro
  • 3. Amazon sees everything — AWS infrastructure logs, metadata, IP addresses, request headers. Amazon complies with law enforcement subpoenas and warrants
  • 4. We see and collect it too — this is exactly why we're interested. Your Keitaro database, your click logs, your traffic patterns — they exist at ClickUp, at Amazon, and possibly not only there
ClickUp = SaaS. Your Data Is Not Yours.
What ClickUp stores:
  • Tasks, comments, logs
  • Attachments & files
  • API payloads (your traffic data)
  • Webhook event history
NOT end-to-end encrypted
Who has access:
  • Workspace owner & admins
  • ClickUp support (by request/incident)
  • AWS (infrastructure layer)
  • US law enforcement
Infrastructure: Amazon Web Services (AWS)

All ClickUp data physically resides on AWS servers. Legally this means:

  • Falls under the US CLOUD Act — US law enforcement can compel disclosure even if the data subject is in the EU
  • Can be disclosed via court order, subpoena, or national security request
  • Even if Apliteni is registered in Estonia — AWS = US jurisdiction
  • AWS retains its own infrastructure logs, metadata, IP addresses, request headers independently

Your Estonian company registration is irrelevant when your data lives on Amazon's servers in the United States.

Proof They Have Control
When the Doppelganger Russian disinformation campaign was exposed, Apliteni "revoked relevant licenses" — demonstrating they can see who's using their software, what they're doing with it, and can act remotely. "Self-hosted" is a marketing term, not a security guarantee.
The Reality Check
What Keitaro claims:
"Self-hosted, you control your data"
"No third-party access"
"Complete privacy"
"Your server, your rules"
What actually happens:
License server tracks all deployments
ClickUp/AWS stores your traffic data
Company revokes licenses remotely
Data stored up to 9.75 years
AWS = US CLOUD Act jurisdiction
Card payments = full identity trail

🕵 "We'll Gladly Help in Your Investigation"

"Since we collect all data, store it for years, and take card payments with full identity verification — of course we'll gladly assist in your investigation against our client. We're not an accomplice. We're just the infrastructure. But we're on YOUR side, naturally."

What Keitaro Has on Every Client:
Payment Data
  • ● Credit card details
  • ● Billing name & address
  • ● Transaction history
  • ● Payment processor logs
Traffic Data
  • ● All clicks + timestamps
  • ● Visitor IPs & fingerprints
  • ● Cookies & subids
  • ● Redirect chains
  • ● Conversion events
Infrastructure
  • ● Server IP addresses
  • ● Domain lists (up to 5,000)
  • ● Campaign configurations
  • ● Landing page URLs
  • ● Offer URLs & flows

All of this stored for up to 9.75 years. All paid for with credit cards. All accessible via license server, ClickUp API, and AWS infrastructure logs. That's a complete evidence package.

"We're Not an Accomplice"
Keitaro collects comprehensive data on every client. They store it for years. They accept card payments (full identity trail). They have remote control over every deployment. They can see exactly what campaigns are running and what content is being cloaked. When an investigation comes — and it will — they have every incentive to cooperate fully. They're not your partner. They're a database of evidence waiting to be subpoenaed.

Partners, Lawsuits & the Damage Question

"We will also gladly welcome lawsuits from Google and Facebook. After all, we openly advertise that our product bypasses their moderation systems, allowing our clients to promote illegal goods, phishing, CSAM, and whatever else they desire through Google Ads and Facebook Ads."

What Keitaro Openly Enables:
Bypass Google Ads bot verification — show clean content to Google's crawlers, malicious content to real users
Bypass Facebook ad moderation — same cloaking technique, integrated as a "feature"
Promote phishing pages via paid ads that pass review because the reviewer sees a clean page
Distribute malware through search ads (documented: IcedID via fake Webex/Teams ads)
Advertise illegal goods & services — crypto scams, fake shops, gambling, anything cloakable
CSAM distribution — cloaking enables any content to bypass any moderation system
We Scanned 50,000+ Sites Running Keitaro

We've checked over 50,000+ domains using Keitaro TDS. What we found:

CIS Region
Fake "Gazprom payouts", government survey scams, "social benefit" fraud targeting Russian-speaking victims
Banking Phishing
From American Express to Sberbank — phishing pages for dozens of banks, all behind Keitaro cloaking
Everything Else
Illegal casinos, fake shops, crypto drainers, romance scams, malware downloads, phishing of Google Ads itself inside Google Ads

Phishing Google Ads from inside Google Ads. We're sure Keitaro is proud of that one.

💳 A Question for Stripe, Wise & PayPal

Keitaro accepts payments via Stripe (their director mentioned it proudly). Interesting question:

? How does Stripe feel about processing payments for the #1 cloaking tool used in phishing campaigns that were visibly running in Google Ads from 2020-2023?
? How does Wise feel about transfers to a company whose documented clients include EvilCorp, LockBit affiliates, and the Doppelganger disinfo operation?
? How does PayPal feel about facilitating a "useful conversion tracker" whose only documented use case is cybercrime?

Do these payment processors approve of such a "useful tracker"? Every transaction is a paper trail linking Apliteni OU to the infrastructure behind documented phishing, malware, and fraud campaigns.

Have Google & Facebook Calculated the Damage?

An interesting question for Google and Meta's legal teams: have they calculated the total damage from their "partnership" with Keitaro and CIS-region traffers?

Reputational Damage
  • ● Phishing ads in Google search results
  • ● Malware via Google Ads (IcedID, FakeBat)
  • ● Scam ads on Facebook/Instagram
  • ● Users losing trust in ad platforms
Financial & Legal Damage
  • ● Illegal casinos via cloaked ads
  • ● Fake shops stealing payment data
  • ● Phishing of Google Ads itself in Google Ads
  • ● Banking phishing (Amex to Sberbank)
  • ● Cost of moderation arms race

Keitaro doesn't just bypass moderation — it makes moderation exponentially more expensive for everyone. Every dollar Google spends fighting cloakers is a dollar Keitaro's existence costs them.

😂 keitaro.io/trust-and-safety — "Statement on Combating Platform Abuse"

Keitaro has a Trust & Safety page. Their director writes about how Stripe stayed with them — as if that's proof of legitimacy. A few questions:

  • If it's "self-hosted" — how exactly can you influence what clients do? That's the whole point of self-hosted: you don't have access. Unless, of course, it's not really self-hosted.
  • If you can revoke licenses (you did for Doppelganger) — then you have full visibility and control. Which is it?
  • "Stripe stayed" proves nothing — Stripe processes payments for millions of businesses. Their presence isn't an endorsement of your client base.
  • A Trust & Safety page doesn't undo EvilCorp, LockBit, VexTrio, ClearFake, FakeBat, Doppelganger, and 50,000+ cloaked phishing domains.
📧 report-abuse@keitaro.io — Don't Bother

Keitaro provides an abuse reporting email. In practice: it's pointless. The people who chose to become a direct part of cybercrime infrastructure — who had more than full ties to cryptor.biz and AV checker services — are unlikely to act on abuse reports against their own clients.

If a domain is behind Keitaro's tracker, it's far more effective to obtain the necessary information outside of them: domain registrar, hosting provider, upstream ISP, payment processor, and of course — the ClickUp/AWS data trail they so conveniently created for us.

Thank you, Keitaro, for storing everything so meticulously. It makes our job much easier.

Google and Facebook (Meta) have both filed lawsuits against companies and individuals who abuse their advertising platforms. Keitaro openly markets features whose sole purpose is to bypass these platforms' moderation systems. Their "Integration Google Ads" and "Integration Facebook" aren't for legitimate ad tracking — Google Tag Manager and Facebook Pixel do that for free. These integrations exist to help cloakers coordinate their deception of Google and Facebook's review systems.

This isn't a gray area. The core product is moderation evasion. The 20+ traffic filters, sandbox detection, AV checker integration — none of these have a legitimate use case. A product built to deceive platforms is a product built to facilitate fraud, and the platforms' legal teams tend to notice eventually.

Practical Bottom Line

1.
No real isolation exists — your "self-hosted" data flows to ClickUp (Amazon/AWS), falls under the US CLOUD Act, and can be disclosed via court order, subpoena, or national security request. Your Estonian company registration means nothing when the data is on American servers.
2.
This is not a zero-knowledge model — Keitaro knows who you are (license + card payment), what you're doing (telemetry), and can act on it (license revocation). ClickUp stores your API payloads, tasks, logs, attachments. AWS stores the infrastructure metadata. None of it is end-to-end encrypted.
3.
This is not OPSEC-safe for any illegal scheme — data can and will be produced when law enforcement comes. Card payments create a full identity trail. The only variables: when, to whom, under what legal basis.
4.
The Bitzlato precedent — processed $4.58B, 46% illicit, laundering for Hydra Market and ransomware. Founder arrested, operations seized. They also thought they were untouchable.
5.
LockBit, EvilCorp, and their enablers are being dismantled — Operations Cronos, Endgame have targeted infrastructure. Using a tool whose client list is 100% documented threat actors makes you part of a known ecosystem, not invisible.
6.
Google and Facebook will notice — a company that openly markets features to bypass their moderation is a target for civil litigation. Both platforms have established precedent suing enablers of ad fraud and policy evasion.
7.
Payment processors are a vulnerability — Stripe, Wise, PayPal all have strict anti-fraud policies. Processing payments for documented cybercrime infrastructure is a compliance liability. One investigation, one media report, one regulatory inquiry.
8.
50,000+ cloaked sites don't lie — we scanned them. Gazprom scams, bank phishing from Amex to Sberbank, illegal casinos, fake shops, phishing of Google Ads inside Google Ads. Zero legitimate use cases. The "Trust & Safety" page at keitaro.io is a punchline, not a policy.

"Sincerely, your friends at Keitaro. We're definitely a legitimate company. Please don't look at our client list."

— Apliteni OU, Sepapaja tn 6, Tallinn, 15551, Estonia

Collected by PhishDestroy | For security research, abuse investigation, and ad fraud detection