Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams

A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777.

Help TDS is assessed to be active since at least 2017, offering PHP code templates to partners and affiliates that are installed into compromised websites with an aim to direct unsuspecting users to tech support scams. These scams make use of full-screen browser manipulation and exit prevention techniques to serve bogus Microsoft Windows security alert screens instructing victims to contact a Windows Support number to address the problem.

"Help TDS delivers tech support scams (TSSs) that direct users to call centers, where social engineering is used to convince them to install remote desktop tools," Infoblox said in a report shared with The Hacker News. "It's not simple credit card fraud: it's remote access, living-off-the-land malware operations. Once in, the threat actor can exploit the victim time and again."

Help TDS's evolution was documented by GoDaddy in August 2025, highlighting the threat actor's use of a malicious WordPress plugin named "woocommerce_inputs" on thousands of websites to steal WordPress user credentials and facilitate the malicious redirections by fetching the URLs from its command-and-control (C2) servers. The plugin, or alternatively a custom HTML block, is injected into the sites by Hotejka's affiliates.

Historical tracking of malicious redirect chains has also uncovered that Help TDS has routinely handed off traffic directly to VexTrio Viper, a cybercrime operator that runs an affiliate program to enable scams, riskware, spyware, adware, and pornographic content.

The latest findings connect the TDS to Hotejka, which, in turn, is suspected to be a successor to ROI777, an entity that was exposed by Guardicore Labs (now part of Akamai) in June 2018 in connection with a traffic manipulation and cryptocurrency mining campaign codenamed Operation Prowli.

The activity involved the compromise of vulnerable servers to deploy a malware named r2r2 and then leverage them to mine cryptocurrency. In tandem, WordPress sites and servers running other content management systems (CMS) were exploited for traffic monetization fraud.

"Traffic monetizers, such as ROI777, buy traffic from 'website operators' such as the Prowli attackers and redirect it to domains on demand," Guardicore Labs noted at the time. "Website 'operators' earn money per traffic sent through roi777. The destination domains frequently host different scams, such as fake services, malicious browser extensions and more."

The rebrand is believed to be driven by the leak of data obtained from ROI777's servers in March 2018, around when it was operating Disposable TDS, a precursor to Help TDS. The published details included Telegram identities of its users and details of multiple campaigns.

The connection between Hotejka and ROI77 doesn't end there, for GoDaddy also found that "roi777[.]com" is one of the historical C2 domains used between 2018 and 2020 to fetch the redirect domains.

"[Hotejka's] affiliates range from spam operators to website compromisers," Infoblox said. "Potential victims are redirected into the TDS from these affiliates via special URLs provided by Hotejka. The TDS then evaluates the user via browser fingerprinting and location to determine the course of action."

A TDS functions akin to a relay, intercepting internet traffic from compromised websites, malicious ads, social media posts, or SEO spam, analyzing the visitor, filter traffic based on predefined criteria (e.g., geographic location, device metadata, IP reputation, and headless browsers), and dynamically route them to scams, browser lockers, or malware drops.

"Help TDS and its precursors are the routing decision infrastructure for a small affiliate program," Infoblox explained. "Other threat actors, for example ones who have compromised websites, send potential victim traffic to the TDS through specially crafted URLs."

The TDS is believed to be implemented on Keitaro, an advertising performance tracking platform that's known to be abused by various threat actors. Some of the initial Help TDS lures prompt users of an impending Windows update, followed by a warning that the machine has been disabled by Microsoft, tells them not to restart the computer, and that a "computer lock" has been put in place to block illegal activity.

The scareware prompt is designed to persuade the victim to contact the Microsoft Technical Support team. Should the victim make the phone call, the threat actor on the other end instructs them to download and install a free remote desktop tool like Ultraviewer to gain complete control of the infected machine.

The fingerprinting step determines whether to route the user to either the tech support scam or to another affiliate marketing platform, which then evaluates the device again and resells the traffic. These pathways lead to scam landing pages with fake CAPTCHA checks to enroll the victim's browser to push-notification spam.

"Historical DNS records, loyal use of other affiliate advertising platforms over the years, and consistent command-and-control (C2) mechanisms give us a high degree of confidence that ROI777 and Hotejka are one and the same," Infoblox said.

Messages posted by Hotejka on their Telegram channel (@hotejka_hot) demonstrate their criminal intent by advertising forced browser extension installations and tech support landing pages that are "very difficult to exit." In one post dated July 17, the operator claimed a "small call center in Germany will handle 50-100 calls per day."

Since April 2026, the scams are run on free Cloudflare Pages sites (*.pages[.]dev), with the threat actor creating roughly 300 disposable pages per day. Over 20,000 such domains have been detected since then. In recent years, Hotejka has also been observed using different aliases on forums like CrackingX, seeking traffic from email spam and access to WordPress admin panels for prices starting at $100.

In all, about 20 different affiliates, including Balada Injector, Detour Dog, and DollyWay, send traffic to Help TDS. These operations are known to heavily target WordPress sites to redirect victims to scams and malware.

"Hotejka/ROI777 has been loyal to the two affiliate platforms since 2017, and we believe that loyalty has paid handsomely," Infoblox said. "Using DNS volumes observed over the past 8 years, our ability to use affiliate IDs to track traffic over time, and commonly cited payout figures for affiliate advertising in general, we suspect that the two European programs have paid them at least a few million dollars (USD)."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.