A sprawling traffic distribution system (TDS) called Help TDS has been linked to a Russian-language affiliate program named Hotejka, which appears to be a rebrand of an older traffic monetization operation known as ROI777. According to a report from The Hacker News, Help TDS has been active since at least 2017 and provides PHP code templates to partners and affiliates. These templates are injected into compromised websites to redirect unsuspecting visitors toward fraudulent tech support pages.
The scale of the operation is significant: more than 20,000 domains hosted on Cloudflare Pages are being used to serve tech support scams. Cloudflare Pages is a legitimate platform for deploying static sites, but attackers have abused its generous free tier and subdomain structure to create a massive network of deceptive landing pages.
What Is Help TDS?
A TDS is a piece of infrastructure that routes web traffic based on a set of rules—such as the visitor's geolocation, device type, or referral source—to different destinations. Legitimate TDS platforms are used for advertising and analytics. Help TDS, however, is designed for malicious redirection. Affiliates install its PHP code on compromised sites, and the TDS then decides whether to send a visitor to a scam page, a malware download, or another malicious endpoint.
The code templates are typically obfuscated to evade detection, and the TDS is believed to have been continuously updated over the years. Its longevity suggests a resilient operation with a steady stream of affiliates and a working monetization model.
The Hotejka Connection
Hotejka is described as a Russian-language affiliate program that appears to be a rebrand of ROI777. Affiliate programs in the cybercrime ecosystem recruit individuals to drive traffic to malicious content in exchange for a cut of the profits. By rebranding, the operators may be attempting to distance themselves from past detection or to refresh their reputation among affiliates.
The link between Help TDS and Hotejka indicates a structured criminal enterprise: Help TDS provides the technical plumbing, while Hotejka handles recruitment, payments, and affiliate management. This division of labor is common in the traffic monetization space, where specialized roles lower the barrier to entry for participants.
Abuse of Cloudflare Pages
The use of over 20,000 Cloudflare Pages domains highlights a growing trend: attackers leveraging trusted cloud services to host malicious content. Cloudflare Pages allows developers to deploy static sites quickly, and each deployment gets a subdomain under pages.dev. Because these domains are associated with Cloudflare's reputable infrastructure, they often bypass security filters that rely on domain reputation.
Tech support scams typically display fake warnings—such as "Your computer is infected"—and a phone number urging the victim to call for help. Once on the line, scammers impersonate Microsoft or Apple support and pressure victims into paying for unnecessary services or installing remote access tools. The financial and privacy impact on victims can be severe.
Why This Matters
The sheer number of domains involved shows how easily cloud platforms can be weaponized at scale. It also underscores the importance of monitoring for abuse on free hosting services. Cloudflare has policies against such abuse, but the volume of deployments makes comprehensive enforcement challenging.
For defenders, the report serves as a reminder that traffic distribution systems remain a core enabler of online scams. Blocking known TDS domains and monitoring for suspicious redirects on compromised websites can help reduce exposure. Users should be wary of unexpected pop-ups and never call phone numbers presented in browser alerts.
The Hacker News report does not specify the exact number of victims or the financial losses involved, but the infrastructure's reach suggests a wide impact. As the affiliate program and TDS continue to operate, staying informed about their tactics is essential for both security professionals and everyday users.
For the full technical details, see the original article: Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams.
