# Traffic distribution system (TDS)

A traffic distribution system (TDS) is a redirect server that decides, per visitor, whether to send them to a scam or malware page or to a harmless one.

## How it works

Ads, spam and hacked sites send visitors to the TDS, which applies rules on country, device, referrer and known security IPs, then redirects. Keitaro is a commercial TDS widely abused this way.

Because the decision happens server-side, the final malicious page is hard to reach for anyone outside the target profile.

## Example from the PhishDestroy database

- [bbasd.com](https://phishdestroy.io/domain/bbasd.com/): Domain whose redirects depended on the visitor, first detected 2026-07-09.
- [defa.digital](https://phishdestroy.io/domain/defa.digital/): Domain whose redirects depended on the visitor, first detected 2026-07-09.
- [alertainusualdecorrespondencia.fwh.is](https://phishdestroy.io/domain/alertainusualdecorrespondencia.fwh.is/): Domain whose redirects depended on the visitor, first detected 2026-07-08.

## How to protect yourself

- Treat chains of redirects through unrelated domains as suspicious.
- Researchers should test from residential IPs and mobile user agents that match the target.

## Related tools

- [Reputation Links](https://phishdestroy.io/developer-tools/reputation-links)
- [URL Parser](https://phishdestroy.io/developer-tools/url-parser)

## Related terms

- [Cloaking](https://phishdestroy.io/glossary/cloaking/)
- [ClickFix](https://phishdestroy.io/glossary/clickfix/)

## Further reading

- [Keitaro TDS Exposed: Traffic Distribution](https://phishdestroy.io/keitaro-tds-exposed)
- [Cloaking & White Pages Explained](https://phishdestroy.io/cloaking-whitepages-explained)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/tds/