Help TDS linked to Hotejka affiliate program as 20,000+ Cloudflare Pages domains host tech support scams
Infoblox links the long-running Help TDS traffic distribution system, active since at least 2017, to the Russian-language affiliate program Hotejka, assessed with high confidence to be a rebrand of the traffic monetization operation ROI777. Help TDS supplies PHP templates and a malicious WordPress plugin that affiliates install on compromised sites to redirect visitors to tech support scams (TSS) showing fake Microsoft Windows security alerts. Victims who call the number are told to install remote desktop tools such as Ultraviewer, giving operators persistent remote access. Since April 2026 the scams have run on free Cloudflare Pages (*.pages[.]dev) sites, with roughly 300 disposable pages created per day and over 20,000 domains detected. About 20 affiliates, including Balada Injector, Detour Dog and DollyWay, feed traffic into the TDS, and Infoblox suspects the operators earned at least a few million USD.
Detalhes técnicos
- Help TDS is believed to be built on Keitaro, an ad performance tracking platform often abused by threat actors.
- Affiliates reach the TDS through special URLs supplied by Hotejka. The TDS fingerprints the browser and location, then routes the visitor either to the TSS or to another affiliate marketing platform that resells the traffic.
- Lures use full-screen browser manipulation and exit prevention, fake Windows update and "computer lock" warnings, and fake CAPTCHA pages that enroll browsers in push-notification spam.
- GoDaddy documented (August 2025) the malicious WordPress plugin woocommerce_inputs, which steals WordPress credentials and fetches redirect URLs from C2 servers. A custom HTML block can be used instead.
- Help TDS has historically passed traffic to VexTrio Viper.
- The ROI777 link rests on historical DNS records, consistent C2 mechanisms, and the domain roi777[.]com, used as a C2 for redirect domains between 2018 and 2020. ROI777 was exposed by Guardicore Labs in 2018 in connection with Operation Prowli (r2r2 malware, cryptomining, traffic fraud), and a March 2018 data leak likely prompted the rebrand. Its precursor TDS was Disposable TDS.
- Hotejka's Telegram channel (@hotejka_hot) advertises forced browser extension installs and hard-to-exit TSS pages. A July 17, 2026 post claimed a small call center in Germany would handle 50-100 calls per day. Hotejka also buys email spam traffic and WordPress admin access on forums such as CrackingX, from $100.
Remediação
- Keep WordPress core, plugins and themes patched. Audit sites for the woocommerce_inputs plugin and unexpected custom HTML blocks, and rotate admin credentials.
- Block or monitor suspicious *.pages[.]dev domains and the redirect chains described above.
- Train users that Microsoft never displays lock screens with support phone numbers, and restrict installation of unapproved remote desktop tools such as Ultraviewer.
Linha do tempo
-
Help TDS linked to Hotejka affiliate program as 20,000+ Cloudflare Pages domains host tech support scams
ler a análise desta fonte ocultar
Infoblox links the long-running Help TDS traffic distribution system, active since at least 2017, to the Russian-language affiliate program Hotejka, assessed with high confidence to be a rebrand of the traffic monetization operation ROI777. Help TDS supplies PHP templates and a malicious WordPress plugin that affiliates install on compromised sites to redirect visitors to tech support scams (TSS) showing fake Microsoft Windows security alerts. Victims who call the number are told to install remote desktop tools such as Ultraviewer, giving operators persistent remote access. Since April 2026 the scams have run on free Cloudflare Pages (*.pages[.]dev) sites, with roughly 300 disposable pages created per day and over 20,000 domains detected. About 20 affiliates, including Balada Injector, Detour Dog and DollyWay, feed traffic into the TDS, and Infoblox suspects the operators earned at least a few million USD.
Technical Details
- Help TDS is believed to be built on Keitaro, an ad performance tracking platform often abused by threat actors.
- Affiliates reach the TDS through special URLs supplied by Hotejka. The TDS fingerprints the browser and location, then routes the visitor either to the TSS or to another affiliate marketing platform that resells the traffic.
- Lures use full-screen browser manipulation and exit prevention, fake Windows update and "computer lock" warnings, and fake CAPTCHA pages that enroll browsers in push-notification spam.
- GoDaddy documented (August 2025) the malicious WordPress plugin woocommerce_inputs, which steals WordPress credentials and fetches redirect URLs from C2 servers. A custom HTML block can be used instead.
- Help TDS has historically passed traffic to VexTrio Viper.
- The ROI777 link rests on historical DNS records, consistent C2 mechanisms, and the domain roi777[.]com, used as a C2 for redirect domains between 2018 and 2020. ROI777 was exposed by Guardicore Labs in 2018 in connection with Operation Prowli (r2r2 malware, cryptomining, traffic fraud), and a March 2018 data leak likely prompted the rebrand. Its precursor TDS was Disposable TDS.
- Hotejka's Telegram channel (@hotejka_hot) advertises forced browser extension installs and hard-to-exit TSS pages. A July 17, 2026 post claimed a small call center in Germany would handle 50-100 calls per day. Hotejka also buys email spam traffic and WordPress admin access on forums such as CrackingX, from $100.
Remediation
- Keep WordPress core, plugins and themes patched. Audit sites for the woocommerce_inputs plugin and unexpected custom HTML blocks, and rotate admin credentials.
- Block or monitor suspicious *.pages[.]dev domains and the redirect chains described above.
- Train users that Microsoft never displays lock screens with support phone numbers, and restrict installation of unapproved remote desktop tools such as Ultraviewer.