Traffic distribution system (TDS)
A traffic distribution system (TDS) is a redirect server that decides, per visitor, whether to send them to a scam or malware page or to a harmless one.
How it works
Ads, spam and hacked sites send visitors to the TDS, which applies rules on country, device, referrer and known security IPs, then redirects. Keitaro is a commercial TDS widely abused this way.
Because the decision happens server-side, the final malicious page is hard to reach for anyone outside the target profile.
Example from the PhishDestroy database
- bbasd.com: Domain whose redirects depended on the visitor, first detected 2026-07-09.
- defa.digital: Domain whose redirects depended on the visitor, first detected 2026-07-09.
- alertainusualdecorrespondencia.fwh.is: Domain whose redirects depended on the visitor, first detected 2026-07-08.
How to protect yourself
- Treat chains of redirects through unrelated domains as suspicious.
- Researchers should test from residential IPs and mobile user agents that match the target.