Beneath the Surface: Detecting and Blocking Hidden Malicious Traffic Distribution Systems
Unit 42 built an ML-based detector for malicious traffic distribution systems, finding malicious TDS chains average longer redirections and more URLs than legitimate ones.
Traffic distribution systems redirect victims through chains of intermediate domains to hide final destinations, serving phishing, malvertising, and online gambling operations. Unit 42's topological analysis of redirection graphs found malicious TDS traffic uses longer chains (about 25% exceed four hops vs 10% benign), more URLs (median 126 vs 80), and fewer isolated subgraphs with higher connectivity. These features power an ML detector integrated into Advanced DNS Security and Advanced URL Filtering to identify and block malicious TDS infrastructure in customer traffic.
- Malicious TDS use longer redirection chains for cloaking and obfuscation
- Median 126 URLs per malicious TDS graph vs 80 for benign
- Malicious TDS graphs show fewer isolated subgraphs and higher connectivity
- TDS helps attackers survive takedowns, evade crawlers, and monetize traffic
- Detector feeds Advanced DNS Security and Advanced URL Filtering
- Organizations
- Unit 42Palo Alto Networks
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 3adating.com | dating-related keywords to create phishing domains such as 3adating[.]com and meetyoursoulmate[.]life . Figure 11. Example of an ad |
| domain | 7eh3gj.lol | registration. For example, xd2kdw[.]lol , ba3e7q[.]lol and 7eh3gj[.]lol were created on August 22, 2024, and began carrying malic |
| domain | ba3e7q.lol | shortly after the registration. For example, xd2kdw[.]lol , ba3e7q[.]lol and 7eh3gj[.]lol were created on August 22, 2024, and beg |
| domain | dappadar.bio | mains including dapparadar[.]app , dappadar[.]community and dappadar[.]bio . Figure 4. Redirection networks of phishing TDS. These s |
| domain | dappadar.community | ontains many squatting domains including dapparadar[.]app , dappadar[.]community and dappadar[.]bio . Figure 4. Redirection networks of ph |
| domain | dapparadar.app | TDS structure. It contains many squatting domains including dapparadar[.]app , dappadar[.]community and dappadar[.]bio . Figure 4. Red |
| domain | meetyoursoulmate.life | words to create phishing domains such as 3adating[.]com and meetyoursoulmate[.]life . Figure 11. Example of an adult-themed phishing site as |
| domain | mobesti.com | o legitimate websites. We identified a recent example using mobesti[.]com for a phishing campaign. Figure 10 shows how this campaig |
| domain | vkmarketing2.com | e same entry website are redirected to different URLs under vkmarketing2[.]com , then to various shady landing pages. Figure 6. Redirect |
| domain | xd2kdw.lol | to the service shortly after the registration. For example, xd2kdw[.]lol , ba3e7q[.]lol and 7eh3gj[.]lol were created on August 22 |
From the original article
9 min read at unit42.paloaltonetworks.com
Many illicit network services, including phishing campaigns and online gambling platforms, exploit traffic distribution systems (TDS) to redirect network traffic. A TDS acts as a central hub, redirecting victims through an often complex network of servers to obfuscate the final destination and hinder detection of these operations.
By Daiping Liu, Wanjin Li, Fan Fei, Zhanhao Chen · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.