The hidden redirect between a familiar website and a scam page.
The page a person clicks is not always the page they ultimately reach.
Cybercriminals are using traffic distribution systems to decide which visitors should be sent to fraudulent login pages, financial scams or malicious software downloads, according to a June 2026 FBI warning.
A traffic distribution system is a routing layer. Legitimate businesses may use similar technology to direct audiences by region or device. Criminal operators abuse it to conceal the final destination and selectively expose only certain visitors to the harmful page.
This explainer is based on the FBI Internet Crime Complaint Center’s June 18, 2026 warning about malicious traffic distribution systems. Read the original alert ↗
How the route begins
The first click may come from a phishing email, a manipulated search result, a fraudulent advertisement or legitimate website code that has been compromised. The routing system evaluates information such as location, browser or device before choosing what to display.
That selectivity complicates detection. A site owner or security reviewer may see a harmless destination while a targeted visitor is redirected elsewhere. The final page may imitate a bank or cloud-service login, present a fake investment offer, or insist that a software update is required.
Clues during navigation
- The address changes through several unfamiliar domains before the page appears.
- A search advertisement imitates a familiar company but the destination domain differs.
- A website unexpectedly asks for credentials, payment or a browser update.
- The same link produces different destinations on different devices or networks.
Reducing exposure
Navigate to sensitive services through a saved bookmark or a manually entered official address. Inspect the final domain before entering credentials. Website operators should review unfamiliar scripts, advertising tags and injected code, and investigate reports that only some users are being redirected.
If a website appears compromised, preserve the original link, redirect chain, screenshots and time of access. The FBI directs affected organizations and individuals to report incidents through IC3 or an FBI field office.
Federal Bureau of Investigation, Internet Crime Complaint Center. “Cyber Criminals Redirecting Users to Fraudulent Websites with Malicious Traffic Distribution Systems,” June 18, 2026.