Help TDS Traffic Distribution System Fuels Tech Support Scams via Cloudflare Pages

A sophisticated traffic distribution system (TDS) known as Help TDS, active since at least 2017 and associated with the Hotejka affiliate program, has been identified as the engine behind tech support scams targeting over 20,000 domains hosted on Cloudflare Pages. This operation, believed to be a rebrand of the ROI777 traffic monetization scheme, leverages PHP code templates to redirect unsuspecting users to fraudulent tech support pages designed to trick them into installing remote access tools.

The Help TDS system provides its affiliates with PHP code templates that are injected into compromised websites. These templates then redirect users to scam pages, which often employ full-screen browser manipulation and exit prevention techniques. The ultimate goal is to present victims with fake Microsoft Windows security alerts, prompting them to call a fraudulent support number. Once victims engage, social engineering tactics are used to convince them to install remote desktop software, granting attackers access to their systems for further exploitation.

Infoblox researchers have detailed how Help TDS's evolution has included the use of malicious WordPress plugins, such as "woocommerce_inputs," to steal WordPress user credentials and fetch malicious redirect URLs from command-and-control (C2) servers. Alternatively, affiliates may inject custom HTML blocks into compromised sites to achieve the same malicious redirection. This method has been observed on thousands of websites, highlighting the broad reach of the operation.

Historical analysis reveals that Help TDS has frequently handed off traffic to VexTrio Viper, another cybercrime operator known for facilitating scams, riskware, spyware, adware, and adult content. The connection to Hotejka, suspected to be a successor to ROI777, is further solidified by the historical use of "roi777[.]com" as a C2 domain between 2018 and 2020. ROI777 itself was previously linked by Guardicore Labs to a campaign involving cryptocurrency mining and traffic monetization fraud.

The rebranding from ROI777 to Hotejka is speculated to be a response to a data leak from ROI777's servers in March 2018, which exposed Telegram identities of its users and campaign details. This leak occurred around the time ROI777 was operating Disposable TDS, a precursor to the current Help TDS system.

Affiliates within the Hotejka program range from spam operators to website compromisers. They provide special URLs to redirect potential victims into the TDS. The TDS then analyzes visitors using browser fingerprinting and location data to determine the appropriate redirection path, which could be the tech support scam or another affiliate marketing platform. This dynamic routing ensures maximum monetization for the operators.

The infrastructure for Help TDS is believed to be implemented on Keitaro, a platform commonly abused by threat actors for advertising performance tracking. The scam lures often mimic urgent Windows update notifications, followed by warnings that the machine has been disabled by Microsoft, instructing users not to restart and claiming a "computer lock" is in place. This scareware tactic is designed to coerce victims into calling the fake Microsoft Technical Support.

Since April 2026, the threat actors have been leveraging free Cloudflare Pages sites to host these scams, creating approximately 300 disposable pages daily. Over 20,000 such domains have been detected, demonstrating the scale and persistence of this operation. Hotejka's Telegram channel has advertised forced browser extension installations and "very difficult to exit" tech support landing pages, with one operator claiming to handle 50-100 calls per day from a "small call center in Germany."