Help TDS Linked to Hotejka as More Than 20,000 Cloudflare Pages Domains Host Tech Support Scams
Summary
Infoblox links Help TDS to Hotejka, which it suspects succeeded ROI777. Since April 2026, the operation has reportedly used more than 20,000 Cloudflare Pages domains to route users to tech support scams and other affiliate content.
Key points
- Help TDS has reportedly operated since at least 2017, routing traffic from compromised websites and other affiliate sources to scams and other destinations.
- Its tech support scams use fake Windows alerts and browser manipulation to pressure victims into calling support numbers; callers may be directed to install remote desktop software.
- Traffic is evaluated using browser fingerprinting and factors such as location and device metadata before being routed to different destinations.
- GoDaddy previously documented use of the malicious WordPress plugin “woocommerce_inputs” to steal WordPress credentials and enable redirects.
- Infoblox assesses Hotejka as a possible successor to ROI777, citing historical DNS records and shared traffic-routing infrastructure.
- Since April 2026, the operation has reportedly created roughly 300 disposable pages per day on *.pages[.]dev, with more than 20,000 domains detected.
- About 20 affiliates reportedly send traffic to Help TDS, including Balada Injector, Detour Dog, and DollyWay.
Article Details
- Attack Vectors
- Affiliates inject a malicious WordPress plugin or custom HTML into compromised websites to redirect visitors through Help TDS.
- Help TDS evaluates visitors using browser fingerprinting and location information, then routes them to tech-support scams, affiliate platforms, or other destinations.
- Tech-support scam pages use fake Windows security alerts and browser-locking behavior to persuade victims to call a support number and install remote desktop software.
- Scam landing pages use fake CAPTCHA checks to enroll visitors in push-notification spam.
- The article reports that Hotejka has used free Cloudflare Pages sites for scam activity since April 2026.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | roi777[.]com | Historical C2 domain used between 2018 and 2020 to fetch redirect domains, according to GoDaddy. |
MITRE ATT&CK
T1189 · Drive-by CompromiseAffiliates inject code into compromised websites to redirect visitors to Help TDS and scam pages.T1219 · Remote Access ToolsScam operators instruct victims to install remote desktop software such as UltraViewer to gain control of their machines.T1656 · ImpersonationFake Microsoft Windows security alerts impersonate technical support to persuade victims to call a support number.
Threat Actors
Balada InjectorNamed affiliate reported to send traffic to Help TDS.Detour DogNamed affiliate reported to send traffic to Help TDS.HotejkaRussian-language affiliate program linked to Help TDS and suspected of being a successor or rebrand of ROI777.ROI777Traffic monetization operation linked to Hotejka; its infrastructure was associated with malicious redirection and the Operation Prowli campaign.VexTrio ViperCybercrime operator to which Help TDS historically handed off traffic.
Malware
Vendors
CloudflareSince April 2026, the scams are run on free Cloudflare Pages sites (*.pages[.]dev), with the threat actor creating roughly 300 disposable pages per day. Over 20,000 such domains have been detected since then. In recentMicrosoftThese scams make use of full-screen browser manipulation and exit prevention techniques to serve bogus Microsoft Windows security alert screens instructing victims to contact a Windows Support number to address the
Products
Cloudflare PagesSince April 2026, the scams are run on free Cloudflare Pages sites (*.pages[.]dev), with the threat actor creating roughly 300 disposable pages per day. Over 20,000 such domains have been detected since then. In recentKeitaroThe TDS is believed to be implemented on Keitaro, an advertising performance tracking platform that's known to be abused by various threat actors. Some of the initial Help TDS lures prompt users of an impending WindowsUltraViewerthreat actor on the other end instructs them to download and install a free remote desktop tool like Ultraviewer to gain complete control of the infected machine.WordPressevolution was documented by GoDaddy in August 2025, highlighting the threat actor's use of a malicious WordPress plugin named "woocommerce_inputs" on thousands of websites to steal WordPress user credentials and