Traffic distribution system (TDS)
A filtering layer in front of a malicious page that decides who gets to see it: the right country, the right browser, not a sandbox, not a crawler. Everyone else is sent somewhere harmless.
Why it matters to you
This is why a reported link looks clean when your analyst opens it. A single fetch from a research address proves nothing about what the victim was served.
Where we meet it
TDS behaviour shows in the shape of the infrastructure rather than in one page fetch, which is why it belongs in the indicator layer instead of a screenshot.
Connected terms
Malvertising
Buying advertising to deliver the lure: a paid result above the real one, pointing at a page that looks like the software the visitor searched for. Distribution with a budget and a targeting console.
Traffer
The distribution worker of the stealer economy: drives victims to infected downloads via malvertising, fake installers, cracked software and phishing. Organized into teams with quotas and payout shares.
ClickFix
A lure that tells the visitor the page is broken and asks them to fix it: copy this, press these keys, paste, run. The victim performs the delivery by hand, so nothing was downloaded and nothing was blocked.
Read elsewhere
Where this term stops being vocabulary
Malveine is where you watch it happen to you
Knowing the word is the cheap half. The platform is the half where the term arrives attached to your domain, with a timestamp and the source it came from.
More from the infrastructure
Antidetect browser
A browser built to present a consistent, disposable fingerprint per profile: its own canvas, fonts, timezone and proxy. Sold so a stolen session can be replayed from a machine that looks like the victim's.
Bulletproof hosting
Hosting sold on the promise that abuse complaints go unanswered and legal requests go unread. Priced well above ordinary hosting, because that indifference is the entire product.
C2 panel
The web console an operator uses to run infected machines: victims listed, tasks queued, output collected. Sold with the malware, screenshotted in the advertisement, and often the most revealing artifact a crew produces.
Crypto mixer
A service that pools cryptocurrency from many senders and pays out from the pool, so that the link between an incoming and an outgoing transaction is broken. Charged as a percentage, sometimes with a delay bought separately.