Candiru Validator Servers: Infrastructure Research & the V1 Fingerprint
A validator server is infrastructure that profiles and confirms target eligibility before an exploit stage is attempted. Citizen Lab identified 305 validator-associated domains across 319 IP addresses matching its V1 fingerprint between August 2022 and July 2026, and noted this fingerprinting behavior began disappearing during May–June 2026.
- Published
- 2026-10-15
- Last reviewed
- 2026-10-18
- Last updated
- 2026-10-18
- Evidence
- CONFIRMED
What a validator is
Conceptually, a validator sits between target selection and exploit delivery. It receives a connection from a selected device, profiles it further, and decides whether to proceed to exploitation. This separation protects the more valuable exploit infrastructure from exposure to non-targets and researchers.
Validator vs exploit server vs C2
| Layer | Role |
|---|---|
| Validator | Profile and confirm target eligibility. |
| Exploit server | Deliver the exploit chain. |
| C2 | Task and exfiltrate from deployed implants. |
Exploit cloaking: conditional creative delivery
The most operationally brilliant aspect of AdFection is selectivity. If a DSP returns an exploit chain to an untargeted user, the infrastructure gets exposed. Eskimi (an ad-verification firm) discovered that Discover-Tech's loaders return vastly different payloads depending on the requester:
Receives a benign, empty, or low-interaction HTML5 banner.
Receives the heavy ADINT/exploit JavaScript.
This defeats "out-of-band" ad scanning. Security teams using headless browsers or proxy IP pools to scan ad inventory see a completely clean ad, while the actual victim received the weaponized payload.
The validator as gatekeeper
Before the browser exploit is executed, the ADINT JavaScript hits the Candiru validator. The validator receives the ADINT fingerprint and cross-references it with the operator's "green-light" criteria before permitting exploitation to proceed. This two-stage gate — conditional creative delivery followed by validator confirmation — keeps the exploit chain hidden from everyone except confirmed targets.
V1 fingerprint findings
The V1 fingerprint matched specific HTTP response banners observable on internet-scan services such as Censys. Example validator domains matching the fingerprint include keyadapter[.]com and sharethere[.]net.
The fingerprinting behavior appeared to begin disappearing during May–June 2026. The HTTP fingerprint is shown only as historical defensive threat-intelligence material. See the infrastructure page.
Last updated 2026-10-18
