CONFIRMED// Citizen Lab 2026v1.0
AdFection & Candiru IOC Database: Searchable Defensive Threat Intelligence
A searchable database of defensive indicators of compromise associated with AdFection, Candiru, DevilsTongue, Discover-Tech, and Controlium infrastructure. All indicators are published for defensive purposes only and are shown in defanged notation.
- Published
- 2026-10-15
- Last reviewed
- 2026-10-18
- Last updated
- 2026-10-18
- Evidence
- CONFIRMED
Warning: Indicators change rapidly. Historical association does not prove current malicious use. Not every hostname under a parent domain is malicious.
| Indicator (defanged) | Type | Component | Campaign | First seen | Last seen | Confidence | Status | Source |
|---|---|---|---|---|---|---|---|---|
| powerium[.]net | domain | discover-tech | AdFection | CONFIRMED | historical | Citizen Lab 2026 | ||
| platc-tester[.]com | domain | discover-tech | AdFection | CONFIRMED | historical | Citizen Lab 2026 | ||
| myweb3id[.]io | domain | discover-tech | AdFection | CONFIRMED | historical | Citizen Lab 2026 | ||
| myipinfo[.]io | domain | discover-tech | AdFection | CONFIRMED | historical | Citizen Lab 2026 | ||
| akedo[.]gg | domain | discover-tech | AdFection | CONFIRMED | historical | Citizen Lab 2026 | ||
| volasim[.]com | domain | discover-tech | AdFection | CONFIRMED | historical | Citizen Lab 2026 | ||
| dtech.adtimizer[.]co | domain | noas | AdFection | REPORTED | historical | Eskimi / Citizen Lab 2026 | ||
| keyadapter[.]com | domain | validator | 2022-08-01 | 2026-07-31 | CONFIRMED | no longer active | Citizen Lab Report 195 (2026) | |
| sharethere[.]net | domain | validator | 2022-08-01 | 2026-07-31 | CONFIRMED | no longer active | Citizen Lab Report 195 (2026) | |
| jobmarcher[.]com | domain | c2 | AdFection / Al Jazeera | 2024-01-01 | 2025-12-31 | CONFIRMED | historical | Citizen Lab Report 195 (2026) |
| insightenterprisells[.]com | domain | c2 | AdFection | 2024-01-01 | 2025-12-31 | CONFIRMED | historical | Citizen Lab Report 195 (2026) |
| plasticbells[.]com | domain | c2 | AdFection | 2024-01-01 | 2025-12-31 | CONFIRMED | historical | Citizen Lab Report 195 (2026) |
| 255869de85e2a171993fc5eb8a556d873a1b8966e040f6f55926f2fa2d595cc8 | hash | implant | AdFection / Al Jazeera | 2024-01-01 | 2025-12-31 | CONFIRMED | historical | Citizen Lab Report 195 (2026) |
| mtrtb[.]com | domain | noas | AdFection | 2026-03-01 | 2026-06-30 | CONFIRMED | no longer active | Citizen Lab Report 195 (2026) |
| discover-tech[.]io | domain | discover-tech | AdFection | 2026-03-01 | 2026-06-30 | CONFIRMED | no longer active | Citizen Lab Report 195 (2026) |
| controlium[.]net | domain | controlium | AdFection | 2026-03-01 | 2026-06-30 | CONFIRMED | no longer active | Citizen Lab Report 195 (2026) |
| mydsp[.]io | domain | discover-tech | AdFection | 2026-03-01 | 2026-06-30 | HIGH CONFIDENCE | no longer active | Citizen Lab Report 195 (2026) |
| fearevolve[.]com | domain | c2 | AdFection / Al Jazeera | 2024-01-01 | 2025-12-31 | CONFIRMED | historical | Citizen Lab Report 195 (2026) |
18 indicators · Last updated 2026-10-18
