FBI: Hidden Redirect Systems Send Users to Fraud Sites

TL;DR: On June 18, 2026, the FBI warned that criminals redirect users to fraudulent websites through malicious traffic distribution systems (TDS). Victims are lured by phishing emails, search engine poisoning or compromised sites, then profiled and sent to phishing pages or malware. The alert does not quantify losses.

👉 Check my digital footprint — free 30-second check →

What happened

In alert I-061826-PSA, the FBI says criminals lure users into a TDS through phishing emails, search engine optimization poisoning that pushes fake ads up in results, or compromised legitimate websites. Attackers often take control of legitimate sites by guessing weak admin passwords or exploiting outdated plugins, then edit the code to send visitors to a TDS.

The TDS passes traffic through a chain of intermediate nodes, hiding the final destination and slipping past firewall rules that block known malicious sites. It profiles visitors by IP address, operating system, location, device and browser, then sends targets to phishing pages or malware and shows harmless content to others, including security researchers.

Why it works

Because a harmless page is shown to some visitors, the same link can look fine to a reviewer and malicious to you. Redirect chains also mean the address you click is not the address you land on.

The FBI says outcomes include online financial fraud, malware infections and network intrusions, and that access gained through an intrusion may be sold to other criminals, including ransomware groups.

Background: our explainers on spear phishing and smishing. See also Doxo to Pay $2.1M Over Bill-Pay Ads Posing as Official Sites and Fake FIFA Websites: FBI Warning Before the World Cup. For wider numbers, see our data page on how scams start (contact methods).

What the FBI advises

Individuals: check URLs before clicking ads, and be wary of look-alike addresses or subdomains of real domains.
Be suspicious of unexpected prompts to download software updates and of sign-up pages for promotions that lead to unfamiliar sites.
Site owners: keep website software and plugins updated, use reputable security plugins or a web application firewall, enforce strong passwords with two-factor authentication and login-attempt limits.
If your site was compromised, file a police report and submit a complaint at ic3.gov.

If you have already sent money

Contact your bank or card issuer immediately and ask to stop or recall the payment, then report it at ReportFraud.ftc.gov and, for internet-enabled crime, to the FBI’s Internet Crime Complaint Center. Our guides on how to report a scam to IC3, how to reverse a wire transfer scam and US bank impersonation scams walk through the steps, and what to do after a scam, wherever you live covers the first 24 hours. Scammers often start with details taken from past leaks, so run our free digital footprint check to see what of yours is already exposed.

Frequently Asked Questions

What is a traffic distribution system?

A chain of intermediate servers that passes visitor traffic along, hides the final destination and profiles visitors so targets are sent to phishing pages or malware.

How do criminals get people into it?

Through phishing emails, search engine optimization poisoning that pushes fake ads up in results, or compromised legitimate websites.

Can I trust a link that looks right?

Not always. The FBI advises checking URLs before clicking ads and watching for deceptive URLs or subdomains of real domains.

Where do I report a compromised website?

File a police report with your local department and submit a complaint at ic3.gov.

FBI Warns That Malicious Traffic Distribution Systems Redirect Users to Fraudulent Websites