Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Beneath the Surface: Detecting and Blocking Hidden Malicious Traffic Distribution Systems

Summary: Unit 42 analyzed redirection graphs from crawling millions of websites daily and found malicious traffic distribution systems differ topologically from benign ones: about 25% of malicious TDS activity has redirection chains longer than four hops versus roughly 10% for benign, and the median malicious TDS contains 126 URLs against 80 for benign. Using 20 graph features, the team built an aggregated machine learning detector that achieves 93% precision at a 0.4% false positive rate, and it also tracked a campaign using 139 DGA-based .lol domains observed from May to October 2024.

What's compelling: Attackers chain multiple intermediate domains specifically to cloak the final landing page, and one campaign's DGA structure kept working even if individual domains were taken down - so blocking a single URL in a chain may leave the operation intact.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026