HotejMain affiliate fraud kit

A campaign name in the redirect chain

Dawid Rycerz's WordPress incident report names HotejMain as the campaign in a traffic-hijacking redirect chain. Our retained website code shows the injected bootstrap that retrieves routing state and constructs a keyed script address.

Routing state becomes a click-stage script

HotejMain's loader sits in website HTML. It hides strings and control flow behind lookup tables, arithmetic and split names, then makes a synchronous XMLHttpRequest to retrieve routing text.

The keyed-click builds check that reply for an oo delimiter. They split the reply into fields, reconstruct a destination host and add a /click?key= route with the configured campaign key. The loader creates a script element for the resulting address and appends it to the page.

The code appears in several forms. One uses httpGet and appa; another uses the script id sggtp with gtg and alpappa. The bewels injection uses gtg and kppa with the same keyed route construction. The ftt build carries var ftt=0 and uses httpGet and appa to retrieve routing state and add the next script.

What we see

Month	New sites
September	21
October so far	26

Among successful captures since 25 September, 18 of 38 HotejMain sites ran WordPress, and 17 made requests for Joomla core paths.

Of the 14 sites recaptured at least 25 days after their first match, 11 still served HotejMain (79%).

Checking a site

Inspect page source, rendered script elements and theme or plugin JavaScript. Look for:

• unfamiliar scripts with the ids sggtp or bewels
• var ftt=0 beside an obfuscated loader
• synchronous XHR inside functions named httpGet or gtg
• routing text split on oo
• a reconstructed /click?key= script address
• functions named appa, alpappa or kppa that add a remote script

Remove the injected loaders and cached copies. Compare templates, themes and plugins with trusted releases, review administrator and hosting access and rotate those credentials.