Traffic Direction Systems (TDS) have become a massive headache for analysts. By fingerprinting IPs, attackers can dynamically route traffic—hiding malicious payloads from security tools while successfully targeting residential, mobile, or specific ASNs.
The problem? Almost every URL scanner out there uses datacenter-based egress IPs. Attackers know this, so they block or cloak against datacenter ranges.
I ran into this wall while investigating malware distributed via a lapsed corporate domain. The standard scanners were returning clean results or blocked pages, but my home connection was still being served malware. Doing the analysis manually was a massive bottleneck, so I built a solution: whack.sh.
What it does: Whack allows you to scan any URL simultaneously through multiple egress options: Datacenter, Residential, Mobile, VPN, and even BYO IP. It then diffs the captures (HAR files) to expose the cloaking, TDS routing, phishing, and malware that traditional datacenter-only scanners miss.
The Origin & Investigation: I’ve been working on this for over a month and have already run over 150,000 scans of known threat URLs. The early MVP was basic but proved the concept: diffing HAR files of the exact same URL across different categorized ASNs immediately exposed the evasion tactics.
I actually reported my initial findings on this specific threat to the FBI IC3 on Monday, June 15th. Three days later, IC3 pushed out a PSA specifically regarding TDS. (I’ll be publishing a few in-depth articles on my company's site detailing these findings in the coming weeks).
Under the Hood (TDS-over-TDS): One of the most interesting things the tool exposed during this process is that TDS isn't just happening at the redirect layer. I found several instances of TDS-over-TDS (redirect layer + payload delivery layer). Malicious actors are using real-time API calls or compressed local IP intelligence to serve entirely different payloads based on the exact environment (e.g., Windows vs. Mobile/Android/Chrome vs. Mobile/iOS/Safari).
Community Integration: I want this data to be useful to the broader community, so any threats found by whack.sh are automatically published to Abuse.ch: https://bazaar.abuse.ch/user/42023/
I’m putting the final polish on the site and planning to officially launch on or before August 4th. In the meantime, I would love to hear your thoughts on the concept! What features would you want to see, or what specific evasion tactics would you want to test against it when it goes live?
Top comments (0)