Help TDS Tied to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams

Researchers linked the long-running Help TDS traffic distribution system to a Russian-language affiliate program called Hotejka, likely a rebrand of ROI777. Active since at least 2017, Help TDS gives partners PHP templates to plant on compromised sites and redirect visitors to tech support scams, with over 20,000 Cloudflare Pages domains involved.

• Help TDS has been active since at least 2017
• Partners get PHP templates for compromised sites
• Over 20,000 Cloudflare Pages domains involved
• Hotejka is assessed as a rebrand of ROI777