Traffic Distribution Systems in the Cybercrime Ecosystem
About this course
An expanded defensive threat-intelligence course built around named case studies and dated evidence. Learners examine Keitaro abuse, ParrotTDS, 404 TDS, Prometheus/Cookie Reloaded, VexTrio, TAG-124/KongTuke, zTDS/DriveSurge, BlackTDS, CloudFront-assisted routing, and bulletproof-hosting providers. It teaches chain reconstruction, network context, cloaking, safe collection, analytic confidence, detection, and disruption while distinguishing legitimate technology, compromised infrastructure, criminal services, and researcher-assigned cluster names.
What you'll learn
- ✓ Explain the complete traffic path from acquisition through TDS classification to decoy, scam, phishing, malware, or monetization outcomes.
- ✓ Distinguish product names, criminal services, actor labels, campaign names, and overlapping researcher terminology.
- ✓ Reconstruct dated case studies involving named TDS platforms and record the networks and services visible at each stage.
- ✓ Explain how bulletproof hosting, compromised sites, shared hosting, CDNs, DNS, and upstream providers can support different parts of the ecosystem.
- ✓ Collect and analyze TDS evidence safely while preserving time, vantage, provenance, confidence, and alternative explanations.
- ✓ Design layered detections and disruption actions that remain useful after domains and infrastructure rotate.
Before you begin
You will get more from this course if these foundations are already familiar.
- Basic web and threat-intelligence knowledge — Learners should understand URLs, domains, DNS, IP addresses, HTTP responses, browser redirects, and basic intelligence concepts such as indicators and confidence.
Course content
Module 1: Module 1: Routing, Filtering, and Names
Builds the technical chain, explains why observations vary, and teaches how to read naming without merging unrelated entities.
What a TDS Does—and Does Not Prove
Start with the routing mechanism before studying criminal services and campaigns.
Why Victims and Sandboxes See Different Pages
Understand cloaking, state, timing, fingerprinting, and negative observations.
A Field Guide to TDS Names
Learn what named systems and clusters represent before using them in an assessment.
Module 2: Module 2: Named Services and Campaigns
Reconstructs Keitaro/Parrot, 404, Prometheus, and VexTrio case families with explicit roles, dates, and infrastructure observations.
Keitaro, ParrotTDS, TA2726, and SocGholish
Follow a current, documented fake-update ecosystem from compromised websites to GhoLoader.
404 TDS and TA584's Changing Initial Access
See how an error response can become a redirect and how one actor changed TDS choices over time.
Prometheus TDS, Cookie Reloaded, and TA866
Learn how cookie-gated filtering and shared routing fit into email-delivered malware chains.
VexTrio: Affiliate Traffic and DNS Routing
Study a large affiliate ecosystem connecting compromised websites, SocGholish, ClearFake, Keitaro, and DNS-based routing.
Module 3: Module 3: Modern and Historical TDS Case Files
Adds TAG-124/KongTuke, zTDS/DriveSurge, BlackTDS, and Sutra while clearly dating infrastructure and label relationships.
TAG-124, KongTuke, LandUpdate808, and Chaya_002
Navigate overlapping labels for a modular compromised-WordPress delivery ecosystem.
zTDS and the 2026 DriveSurge Cluster
Examine an open-source TDS abused at scale and a current infrastructure fingerprint.
BlackTDS, Sutra, and the Drive-by Service Model
Use historical criminal services to understand how today's specialized traffic markets developed.
Module 4: Module 4: Hosting, Networks, Investigation, and Disruption
Separates bulletproof hosting from TDS operation, then connects network dependencies to safe investigation and layered disruption.
Bulletproof Hosting in the TDS Ecosystem
Understand what bulletproof hosting provides, how it differs from ordinary hosting abuse, and which named providers were publicly designated.
Fast Flux, Shared Hosting, CDNs, and Cloud
Compare network patterns that create resilience without labeling every enabling service bulletproof.
Investigate and Disrupt the Complete Chain
Turn observations into a safe evidence package, resilient detections, and coordinated action.