← Traffic Distribution Systems in the Cybercrime Ecosystem
Module 1: Routing, Filtering, and Names
What a TDS Does—and Does Not Prove Why Victims and Sandboxes See Different Pages A Field Guide to TDS Names
Module 2: Named Services and Campaigns
Keitaro, ParrotTDS, TA2726, and SocGholish 404 TDS and TA584's Changing Initial Access Prometheus TDS, Cookie Reloaded, and TA866 VexTrio: Affiliate Traffic and DNS Routing
Module 3: Modern and Historical TDS Case Files
TAG-124, KongTuke, LandUpdate808, and Chaya_002 zTDS and the 2026 DriveSurge Cluster BlackTDS, Sutra, and the Drive-by Service Model
Module 4: Hosting, Networks, Investigation, and Disruption
Bulletproof Hosting in the TDS Ecosystem Fast Flux, Shared Hosting, CDNs, and Cloud Investigate and Disrupt the Complete Chain
Module 1: Routing, Filtering, and Names

What a TDS Does—and Does Not Prove

Start with the routing mechanism before studying criminal services and campaigns.

In this lesson, you will learn to:

  • Diagram a complete TDS-assisted chain.
  • Distinguish routing capability from malicious intent and final payload behavior.

What a TDS Does—and Does Not Prove

Defines traffic acquisition, classification inputs, state, routing outcomes, customer campaigns, and the distinction between dual-use technology and malicious operation.

A TDS is a decision layer

A traffic distribution system receives a visit or click, evaluates available attributes against rules, and selects a destination. Inputs can include the campaign token, referrer, IP-derived country, network reputation, operating system, browser, language, time, cookies, visit count, and signs of automation. The output may be a redirect, script, page, error, download, or no response.

Authorized marketers use comparable routing for localization, experiments, fraud controls, and campaign measurement. Criminal use is established by behavior and context: unauthorized injection, deception, credential theft, malware delivery, evasion, or knowing support for harmful customers. “Uses geolocation” and “runs Keitaro” do not by themselves prove crime. Analysts must connect the routing layer to acquisition and outcome evidence.

The visitor-filter switchboardA switchboard routes several incoming visitor profiles toward different destinations.LEARN IT VISUALLYThe visitor-filter switchboardVisitor AVisitor BCrawlerRepeat visit
The visitor-filter switchboard — A switchboard routes several incoming visitor profiles toward different destinations.

The chain begins before the TDS

Traffic must be acquired. Sources include phishing links, malicious advertisements, search-engine optimization poisoning, social posts, compromised websites, browser notifications, affiliate traffic, and look-alike download portals. An entry page or injected script passes the visitor into one or more routing layers. Qualified traffic may then reach a fake update, ClickFix instruction, credential page, scam, exploit kit, unwanted program, or malware file. Other visitors receive a benign page or legitimate destination.

Document each handoff separately: source, entry asset, client-side injection, TDS endpoint, intermediate controller, landing page, file host, execution, and downstream command-and-control. A TDS is often neither the first nor last component. Collapsing the chain into one “malicious domain” hides dependencies and creates brittle detection.

A five-scene TDS attack pathA storyboard follows acquired traffic through entry, routing, lure, and final outcome.LEARN IT VISUALLYA five-scene TDS attack path1Traffic source2Entry page3TDS gate4Lure5Outcome
A five-scene TDS attack path — A storyboard follows acquired traffic through entry, routing, lure, and final outcome.

Maliciousness belongs to the observed operation

A legitimate tracking product can be abused. A legitimate website can be compromised. A CDN can unknowingly serve an actor’s script. Shared hosting can contain unrelated customers. Conversely, a service can be designed or marketed to resist abuse response. Use language that matches the evidence: “the campaign used,” “the actor-controlled instance ran,” “the compromised site loaded,” or “the provider was designated for supporting cybercrime.”

MITRE ATT&CK maps malicious advertisements and compromised websites that expose a victim through the browser to Drive-by Compromise, T1189. The TDS usually mediates selection rather than describing every follow-on technique. Keep behavioral mappings precise enough that defenders know which control sees which stage.

Resources

  • FBI 2026 TDS Public Service Announcement — Use the FBI’s current description of acquisition, filtering, fraudulent destinations, malware, access sale, and public protection.
  • MITRE ATT&CK T1189 — Map compromised websites and malicious advertising to the Drive-by Compromise behavior.
Next: Why Victims and Sandboxes See Different Pages →