Infoblox Threat Intel

Detour Dog is a persistent threat actor that controls an ecosystem of compromised websites. Their techniques include using DNS TXT records to instruct infected websites to redirect visitors or fetch remote content. This enables Detour Dog to distribute scams and malware as an affiliate with other actors.

Detour Dog has been an affiliate of Help TDS, Monetizer, Los Pollos, and others. Detour Dog distributed the StarFish backdoor and Strela Stealer for Hive0145.

• Operating since: 2020
• Infoblox discovered: 2023
• Infoblox published: 2025
• Prevalence: Uncommon