ApateWeb: An Evasive Large-Scale Scareware and PUP Delivery Campaign
Unit 42 uncovers ApateWeb, a campaign using over 130,000 domains and multilayered redirects to deliver scareware, adware and PUPs to millions of users.
Unit 42 discovered ApateWeb, a large-scale campaign using a network of more than 130,000 domains to deliver scareware, potentially unwanted programs, adware including a rogue browser and browser extensions, and scam pages. The campaign uses a three-layer structure with deceptive emails as the entry point, centralized victim tracking via UUIDs, intermediate adware or anti-bot redirections, and evasion tactics such as cloaking, bot detection error pages, and wildcard DNS abuse. Activity spiked since August 2022, with several hundred attacker-controlled sites remaining in Tranco's top 1 million rankings and millions of monthly hits; Unit 42 blocked an estimated 3.5 million sessions across 74,711 devices in November 2023.
- Campaign spans over 130,000 domains with three layers of redirection and centralized victim tracking via UUIDs.
- Evasion includes cloaking, error pages for bots, and wildcard DNS abuse to generate many subdomains.
- Several hundred attacker sites persist in Tranco's top 1 million rankings with millions of monthly hits.
- Unit 42 blocked roughly 3.5 million sessions across 74,711 devices in November 2023.
- Vendors
- Palo Alto Networks
- Products
- Tranco
- Countries
- United States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ad-blocking24.net | affic forwarded to adware tracker-tds[.]info jpadsnow[.]com ad-blocking24[.]net Myqenad24[.]com PUP download example: bd62d3808ef29c557da |
| domain | allureoutlayterrific.com | e99 artificius[.]com Other campaign domains: hoanoola[.]net allureoutlayterrific[.]com Acknowledgements We’d like to thank the entire Unit 42 te |
| domain | artificius.com | s unwanted redirects. This browser opens its own website at artificius[.]com when victims open a new tab or window. Figure 10 illustra |
| domain | experttrafficmonitor.com | eck[.]com hightrafficcounter[.]com proftrafficcounter[.]com experttrafficmonitor[.]com IP addresses hosting campaign entry point 192[.]243[.]59[ |
| domain | featuresscanner.com | nce . Indicators of Compromise Campaign entry point example featuresscanner[.]com Domains part of centralized infrastructure to track victi |
| domain | hightrafficcounter.com | contact the centralized server. professionalswebcheck[.]com hightrafficcounter[.]com proftrafficcounter[.]com experttrafficmonitor[ . ]com For |
| domain | hoanoola.net | e5128c96f2ff5b5e99 artificius[.]com Other campaign domains: hoanoola[.]net allureoutlayterrific[.]com Acknowledgements We’d like to |
| domain | jpadsnow.com | ic forwarded to adware sites such as tracker-tds[.]info and jpadsnow[.]com . The redirection URL includes several parameters to shar |
| domain | myqenad24.com | dware tracker-tds[.]info jpadsnow[.]com ad-blocking24[.]net Myqenad24[.]com PUP download example: bd62d3808ef29c557da64b412c4422935a6 |
| domain | professionalswebcheck.com | recently rotated through to contact the centralized server. professionalswebcheck[.]com hightrafficcounter[.]com proftrafficcounter[.]com expertt |
| domain | proftrafficcounter.com | erver. professionalswebcheck[.]com hightrafficcounter[.]com proftrafficcounter[.]com experttrafficmonitor[ . ]com For example, the campaign co |
| domain | tracker-tds.info | e saw examples of traffic forwarded to adware sites such as tracker-tds[.]info and jpadsnow[.]com . The redirection URL includes several |
| ipv4 | 173.233.137.36 | [.]233[.]137[.]60 173[.]233[.]137[.]52 173[.]233[.]137[.]44 173[.]233[.]137[.]36 These IP addresses belong to two Autonomous System (A |
| ipv4 | 173.233.137.44 | .]233[.]139[.]164 173[.]233[.]137[.]60 173[.]233[.]137[.]52 173[.]233[.]137[.]44 173[.]233[.]137[.]36 These IP addresses belong to two |
| ipv4 | 173.233.137.52 | .]243[.]61[.]225 173[.]233[.]139[.]164 173[.]233[.]137[.]60 173[.]233[.]137[.]52 173[.]233[.]137[.]44 173[.]233[.]137[.]36 These IP ad |
| ipv4 | 173.233.137.60 | .]243[.]61[.]227 192[.]243[.]61[.]225 173[.]233[.]139[.]164 173[.]233[.]137[.]60 173[.]233[.]137[.]52 173[.]233[.]137[.]44 173[.]233[. |
| ipv4 | 173.233.139.164 | 2[.]243[.]59[.]12 192[.]243[.]61[.]227 192[.]243[.]61[.]225 173[.]233[.]139[.]164 173[.]233[.]137[.]60 173[.]233[.]137[.]52 173[.]233[. |
| ipv4 | 192.243.59.12 | ng 10 IP addresses: 192[.]243[.]59[.]20 192[.]243[.]59[.]13 192[.]243[.]59[.]12 192[.]243[.]61[.]227 192[.]243[.]61[.]225 173[.]233[. |
| ipv4 | 192.243.59.13 | solve to the following 10 IP addresses: 192[.]243[.]59[.]20 192[.]243[.]59[.]13 192[.]243[.]59[.]12 192[.]243[.]61[.]227 192[.]243[.] |
| ipv4 | 192.243.59.20 | ApateWeb domains resolve to the following 10 IP addresses: 192[.]243[.]59[.]20 192[.]243[.]59[.]13 192[.]243[.]59[.]12 192[.]243[.]6 |
| ipv4 | 192.243.61.225 | 92[.]243[.]59[.]13 192[.]243[.]59[.]12 192[.]243[.]61[.]227 192[.]243[.]61[.]225 173[.]233[.]139[.]164 173[.]233[.]137[.]60 173[.]233[ |
| ipv4 | 192.243.61.227 | 192[.]243[.]59[.]20 192[.]243[.]59[.]13 192[.]243[.]59[.]12 192[.]243[.]61[.]227 192[.]243[.]61[.]225 173[.]233[.]139[.]164 173[.]233[ |
| sha256 | bd62d3808ef29c557da64b412c4422935a641c22e2bdcfe5128c96f2ff5b5e99 | m ad-blocking24[.]net Myqenad24[.]com PUP download example: bd62d3808ef29c557da64b412c4422935a641c22e2bdcfe5128c96f2ff5b5e99 artificius[.]com Other campaign domains: hoanoola[.]net all |
From the original article
13 min read at unit42.paloaltonetworks.com
Unit 42 researchers discovered a large-scale campaign we call ApateWeb that uses a network of over 130,000 domains to deliver scareware, potentially unwanted programs (PUPs) and other scam pages. Among these PUPs, we have identified several adware programs including a rogue browser and different browser extensions.
unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.