A malicious traffic redirect happens when your employee clicks what appears to be a safe link (maybe from a search result, a saved bookmark, or even a legitimate business website) and ends up on a fraudulent page designed to steal credentials or deploy malware. The FBI recently issued a public service announcement warning businesses about this exact threat, and for good reason. These attacks are effective because they feel invisible.
What is a malicious traffic redirect and how does it work?
Here’s the short version. Criminals compromise legitimate websites (small business sites, hobby blogs, outdated WordPress installations) and insert code that silently evaluates every visitor. This code connects to a traffic distribution system, or TDS, which acts like an air traffic controller for cybercrime. The TDS decides in milliseconds whether you’re a valuable target. If you are, it redirects your browser to a fake login page, a tech support scam, or a site that downloads ransomware. If you’re not (maybe you’re a security researcher or visiting from a blacklisted IP), it shows you the normal website and you never know the attack infrastructure was there.
For a manufacturing company in Hartford or a law firm in Litchfield County, this plays out in frustrating ways. An accounting manager searches for the company bank portal, clicks the top result, and lands on a pixel-perfect fake login page. She enters her credentials. Two days later, your accounts payable system starts sending wire transfers to Romania.
Why are traffic distribution systems so dangerous for small and mid-sized businesses?
Traffic distribution systems are dangerous because they add a layer of intelligence to old-fashioned phishing. Traditional phishing sends the same fake page to everyone and hopes someone bites. A TDS tailors the attack. It can filter by geographic location (only show the scam to Connecticut users), by device type (only target Windows machines), by browser (only redirect Chrome users), or even by time of day (only attack during business hours when employees are rushing).
This means the attack surface is smaller and harder to detect. Security researchers scanning the web might visit the compromised site and see nothing wrong. Your employee visiting from the office sees a credential theft page. The system is designed to evade detection while maximizing success against real targets.
And because the initial click often starts on a legitimate site, email filters and traditional anti-phishing training don’t catch it. Your team has been taught not to click suspicious email links. But a Google search result? A vendor website they’ve used for years? Those feel safe, even when they’ve been quietly weaponized.
What happens after a malicious traffic redirect sends someone to a fake site?
Once the redirect delivers your employee to the fraudulent page, the playbook is straightforward. If it’s a credential harvesting page, it will mimic a service your business uses: Microsoft 365, Google Workspace, a bank portal, QuickBooks Online, or a payroll system. The page looks identical to the real thing. Logos, colors, fonts, even the SSL padlock in the address bar (criminals can buy certificates too). Your employee types in their username and password. The page says “login failed, please try again” and redirects them to the real site. They assume it was a glitch. Meanwhile, the credentials are already for sale on a dark web forum or being used to access your systems.
If the fake site is designed to install malware, it might prompt a software update (“Your browser is out of date, click here to continue”) or a document download (“Invoice_June_2023.pdf.exe”). One click installs remote access tools, keyloggers, or ransomware. The infection spreads laterally across your network, often undetected for weeks.
The consequence for a professional services firm or a small manufacturer is not abstract. It’s the paralysis of your billing system, the theft of client data you’re contractually obligated to protect, or the ransom demand that arrives three days before month-end close.
How can you protect your business from traffic redirect attacks?
Protection starts with visibility and verification. DNS filtering is your first layer. A good DNS security service (like Cisco Umbrella, Cloudflare Gateway, or similar) blocks requests to known malicious domains and newly registered domains often used in redirect schemes. When an employee’s browser tries to load the fraudulent page, the DNS filter stops the request before the page ever renders.
Browser security matters. Modern browsers include phishing and malware protection (Google Safe Browsing, Microsoft SmartScreen), but they need to be enabled and kept up to date. Disable outdated browsers entirely. Internet Explorer, for example, is no longer supported and lacks the security features that catch many redirect attacks.
Train your team to verify URLs before entering credentials. Teach them to look at the address bar, not just the page content. “microsoft-login-secure.com” is not the same as “login.microsoftonline.com.” If a page asks for a password, pause and check the URL. If it looks even slightly off, close the tab and navigate to the site manually by typing the address or using a saved bookmark.
Use password managers. A good password manager will only autofill credentials on the legitimate domain. If your manager doesn’t offer to fill in your Microsoft password, that’s a red flag that you’re on a fake page.
Finally, implement multi-factor authentication (MFA) everywhere. Even if credentials are stolen via a malicious traffic redirect, MFA stops the attacker at the login screen. They have the password, but they don’t have the code from your phone. It’s not perfect (some sophisticated attacks can bypass MFA), but it raises the bar significantly.
What should you do if you suspect someone on your team was redirected to a scam site?
Act immediately. If an employee reports that a login “felt weird” or they entered credentials on a page that looked slightly off, assume compromise. Reset the password for that account right away. Check login logs for unusual access (logins from foreign countries, odd times, unfamiliar devices). If your email or financial systems show any suspicious activity, disable the account and escalate to your IT team or managed security provider.
Scan the device the employee was using. Run a full antivirus and anti-malware scan. If anything is detected, isolate the machine from the network until it’s cleaned or reimaged.
Review recent transactions and data access. Look for unauthorized wire transfers, changes to payroll direct deposit information, or access to sensitive client files. The faster you catch the misuse, the smaller the damage.
Report the incident. If the fake site impersonated a bank or a major software provider, report it to that organization’s abuse team. If you’re in a regulated industry (legal, healthcare, finance), check whether the incident triggers breach notification requirements. And consider filing a report with the FBI’s Internet Crime Complaint Center (IC3), especially if financial loss occurred. The data helps law enforcement track these campaigns.
Do small businesses really need to worry about these sophisticated attacks?
Yes, because the attacks are no longer sophisticated to deploy. Traffic distribution systems are sold as a service. A low-skill criminal can rent access to a TDS, upload a phishing page template, and start redirecting traffic in an afternoon. The barrier to entry is gone.
And small businesses are often easier targets than enterprises. You may lack a dedicated security team, employee training may be inconsistent, and browser or DNS security might not be centrally managed. Attackers know this. The goal is volume. A hundred small credential thefts are just as profitable as one large breach, and they’re less likely to make headlines.
The risk is not hypothetical. A professional services firm loses client trust after a data breach tied to stolen credentials. A manufacturer faces production downtime when ransomware spreads from an infected laptop. A financial advisor loses their license after a fraudulent wire transfer drains a client account. These are not worst-case scenarios. They are Tuesday.
Frequently Asked Questions
Can antivirus software stop a malicious traffic redirect?
Traditional antivirus can catch malware delivered after a redirect, but it usually won’t stop the redirect itself. DNS filtering and browser-based phishing protection are more effective at blocking the initial redirect before the fraudulent page loads.
How do criminals choose which websites to compromise for redirect attacks?
Attackers target websites with known vulnerabilities (outdated WordPress plugins, unpatched content management systems) or weak credentials. Small business websites, personal blogs, and niche industry sites are common targets because they’re numerous and often under-maintained.
Will multi-factor authentication completely prevent damage from a stolen password?
Multi-factor authentication significantly reduces risk, but determined attackers can use real-time phishing proxies to intercept MFA codes or push notification fatigue to trick users into approving a login. MFA is essential, but it works best paired with DNS filtering, employee training, and monitoring for unusual login behavior.
What’s the difference between a malicious redirect and a phishing email link?
A phishing email contains a link that goes directly to a fake site. A malicious traffic redirect starts on a legitimate or compromised website and uses code to bounce the visitor to a fraudulent page. Redirects are harder to detect because the initial site may look trustworthy and email filters don’t see the attack.
Should I be concerned if I visited a site and nothing suspicious happened?
Possibly. Traffic distribution systems often show different content to different visitors. Security tools, researchers, or users outside the target geography may see the normal site. If colleagues report issues or you later hear the site was compromised, change any passwords you may have entered and scan your device as a precaution.
Keep reading
Sources
Source: Cyber Criminals Redirecting Users to Fraudulent Websites with Malicious Traffic Distribution Systems