Beneath the Surface: Detecting and Blocking Hidden Malicious Traffic Distribution Systems

This Unit 42 report analyzes how adversaries abuse Traffic Distribution Systems (TDS) to build resilient, scalable redirection networks for phishing, malvertising, illicit gambling/adult services and cloaking. It presents large-scale topological findings showing malicious TDS have longer redirection chains, more distinct URLs and higher connectivity; provides case studies and IoCs (including ~139 .lol DGA domains and specific domains); and describes an ML-based detector claimed to achieve 93% precision and 0.4% false positive rate.