← Traffic Distribution Systems in the Cybercrime Ecosystem
Module 1: Routing, Filtering, and Names
What a TDS Does—and Does Not Prove Why Victims and Sandboxes See Different Pages A Field Guide to TDS Names
Module 2: Named Services and Campaigns
Keitaro, ParrotTDS, TA2726, and SocGholish 404 TDS and TA584's Changing Initial Access Prometheus TDS, Cookie Reloaded, and TA866 VexTrio: Affiliate Traffic and DNS Routing
Module 3: Modern and Historical TDS Case Files
TAG-124, KongTuke, LandUpdate808, and Chaya_002 zTDS and the 2026 DriveSurge Cluster BlackTDS, Sutra, and the Drive-by Service Model
Module 4: Hosting, Networks, Investigation, and Disruption
Bulletproof Hosting in the TDS Ecosystem Fast Flux, Shared Hosting, CDNs, and Cloud Investigate and Disrupt the Complete Chain
Module 1: Routing, Filtering, and Names

Why Victims and Sandboxes See Different Pages

Understand cloaking, state, timing, fingerprinting, and negative observations.

In this lesson, you will learn to:

  • Record a reproducible observation vantage.
  • Interpret benign or missing content without erasing earlier evidence.

Why Victims and Sandboxes See Different Pages

Shows how geography, network type, device, referrer, cookies, clicks, frequency caps, and campaign expiry produce divergent but simultaneously valid observations.

The visible page may be the decoy

A TDS can show benign content to crawlers, datacenter addresses, VPN exits, unsupported countries, mobile devices, repeat visitors, or requests without a valid campaign token. The harmful branch may require a residential IP, matching operating system, first visit, real referrer, cookie, mouse click, or narrow time window. Server-side logic remains hidden; the client sees only the selected response.

In June 2026, Check Point described impersonation sites whose CloudFront-hosted staging scripts enforced first-visit state, mandatory click confirmation, anti-bot logic, VPN or datacenter filtering, and frequency caps. More than 100 active sites reused the staging pattern at the time of reporting. CloudFront is a legitimate CDN; the finding concerns actor-controlled content delivered through it, not the service as a whole.

One URL behind five observation shuttersDifferent shutters expose victim, crawler, sandbox, VPN, and repeat-visit views.LEARN IT VISUALLYOne URL behind five observation shuttersVictimCrawlerSandboxVPNRepeat visit
One URL behind five observation shutters — Different shutters expose victim, crawler, sandbox, VPN, and repeat-visit views.

Record the observation conditions

For each request, record event time and collection time with time zone, source network category, geography, device and operating system, browser and headers, referrer, cookies or local state, campaign parameters, interaction performed, response status, redirect order, and safety controls. “The URL is benign” is too broad. “No harmful content was observed from this cloud-hosted browser at 14:20 UTC without prior cookies” is bounded and reproducible.

Do not bypass safeguards or impersonate protected populations without authority. Begin with existing DNS, proxy, email-click, browser, endpoint, and incident evidence. If controlled reproduction is justified, use an isolated environment, safe accounts, restricted egress, and documented procedures. A negative result is valuable evidence about that vantage; it is not proof that a victim’s earlier observation was false.

Name the thing you actually observedA taxonomy wall separates product, service, actor, campaign, and analytical-overlap labels.LEARN IT VISUALLYName the thing you actually observedKeitaroproductTA2726serviceSocGholishactor labelTAG-124campaign labelName overlapoverlap
Name the thing you actually observed — A taxonomy wall separates product, service, actor, campaign, and analytical-overlap labels.

Divergence has competing explanations

Filtering is one explanation for different results. Infrastructure churn, campaign expiry, remediation, load balancing, A/B testing, broken code, or a one-time visit ledger can produce the same symptom. Compare repeated authorized observations, victim telemetry, passive DNS, archived content, and trusted reporting. State which explanation the evidence supports and what remains possible.

Preserve status codes and response bodies. An HTTP error does not guarantee that the chain ended; scripts or HTML can still redirect. Likewise, reaching a final download does not prove execution. A good chain report keeps observed navigation, delivered content, user interaction, process execution, credential entry, and later account activity as separate facts.

Resources

  • Check Point 2026 TDS Ecosystem — Study the current CloudFront-assisted staging, click gating, anti-analysis behavior, and impersonated software sites.
← Previous: What a TDS Does—and Does Not Prove Next: A Field Guide to TDS Names →