FREE COURSE / SELF-PACED LEARNING

Traffic Distribution Systems in the Cybercrime Ecosystem

Study malicious traffic routing, TDS evidence and infrastructure dependencies in this free course on the cybercrime ecosystem.

Read the first lesson Explore the curriculum

Read freely. Create an account to save your completed lessons.

Experience level
Intermediate
Curriculum
4 modules · 13 lessons
Estimated reading
40 min
Language
English

Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.

KNOW WHAT YOU’RE WORKING TOWARD

What you’ll learn

  • Explain the complete traffic path from acquisition through TDS classification to decoy, scam, phishing, malware, or monetization outcomes.
  • Distinguish product names, criminal services, actor labels, campaign names, and overlapping researcher terminology.
  • Reconstruct dated case studies involving named TDS platforms and record the networks and services visible at each stage.
  • Explain how bulletproof hosting, compromised sites, shared hosting, CDNs, DNS, and upstream providers can support different parts of the ecosystem.
  • Collect and analyze TDS evidence safely while preserving time, vantage, provenance, confidence, and alternative explanations.
  • Design layered detections and disruption actions that remain useful after domains and infrastructure rotate.

Is this the right course for you?

Who it’s for

Threat analysts studying traffic-routing infrastructure and dated campaign evidence.

Scope and boundaries

Defensive analysis of routing behavior and source claims. Names and infrastructure associations require time, provenance and corroboration.

How you’ll learn

Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.

Before you begin

  • Basic web and threat-intelligence knowledge — Learners should understand URLs, domains, DNS, IP addresses, HTTP responses, browser redirects, and basic intelligence concepts such as indicators and confidence.

About this course

An expanded defensive threat-intelligence course built around named case studies and dated evidence. Learners examine Keitaro abuse, ParrotTDS, 404 TDS, Prometheus/Cookie Reloaded, VexTrio, TAG-124/KongTuke, zTDS/DriveSurge, BlackTDS, CloudFront-assisted routing, and bulletproof-hosting providers. It teaches chain reconstruction, network context, cloaking, safe collection, analytic confidence, detection, and disruption while distinguishing legitimate technology, compromised infrastructure, criminal services, and researcher-assigned cluster names.

FOLLOW THE LEARNING PATH

Course curriculum

MODULE 1

Module 1: Routing, Filtering, and Names

Builds the technical chain, explains why observations vary, and teaches how to read naming without merging unrelated entities.

  1. What a TDS Does—and Does Not ProveStart with the routing mechanism before studying criminal services and campaigns.3 min reading
  2. Why Victims and Sandboxes See Different PagesUnderstand cloaking, state, timing, fingerprinting, and negative observations.3 min reading
  3. A Field Guide to TDS NamesLearn what named systems and clusters represent before using them in an assessment.3 min reading

MODULE 2

Module 2: Named Services and Campaigns

Reconstructs Keitaro/Parrot, 404, Prometheus, and VexTrio case families with explicit roles, dates, and infrastructure observations.

  1. Keitaro, ParrotTDS, TA2726, and SocGholishFollow a current, documented fake-update ecosystem from compromised websites to GhoLoader.3 min reading
  2. 404 TDS and TA584's Changing Initial AccessSee how an error response can become a redirect and how one actor changed TDS choices over time.3 min reading
  3. Prometheus TDS, Cookie Reloaded, and TA866Learn how cookie-gated filtering and shared routing fit into email-delivered malware chains.3 min reading
  4. VexTrio: Affiliate Traffic and DNS RoutingStudy a large affiliate ecosystem connecting compromised websites, SocGholish, ClearFake, Keitaro, and DNS-based routing.3 min reading

MODULE 3

Module 3: Modern and Historical TDS Case Files

Adds TAG-124/KongTuke, zTDS/DriveSurge, BlackTDS, and Sutra while clearly dating infrastructure and label relationships.

  1. TAG-124, KongTuke, LandUpdate808, and Chaya_002Navigate overlapping labels for a modular compromised-WordPress delivery ecosystem.3 min reading
  2. zTDS and the 2026 DriveSurge ClusterExamine an open-source TDS abused at scale and a current infrastructure fingerprint.3 min reading
  3. BlackTDS, Sutra, and the Drive-by Service ModelUse historical criminal services to understand how today's specialized traffic markets developed.3 min reading

MODULE 4

Module 4: Hosting, Networks, Investigation, and Disruption

Separates bulletproof hosting from TDS operation, then connects network dependencies to safe investigation and layered disruption.

  1. Bulletproof Hosting in the TDS EcosystemUnderstand what bulletproof hosting provides, how it differs from ordinary hosting abuse, and which named providers were publicly designated.4 min reading
  2. Fast Flux, Shared Hosting, CDNs, and CloudCompare network patterns that create resilience without labeling every enabling service bulletproof.3 min reading
  3. Investigate and Disrupt the Complete ChainTurn observations into a safe evidence package, resilient detections, and coordinated action.3 min reading

Sources and editorial review

Reviewed by Threat Intelligence Lab

Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.

Selected references are shown here; the lessons contain the full reading lists.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.