Help TDS and Hotejka Affiliate Network Linked to 20,000+ Compromised Sites Pushing Tech Support Scams

What Happened

Researchers reported on a long-running Traffic Distribution System (TDS) known as Help TDS, active since at least 2017, that has been tied to a Russian-language affiliate program called Hotejka — itself assessed to be a rebrand of a prior traffic-monetization operation dubbed ROI777. According to the report, Help TDS provides PHP code templates to its affiliates and partners, which are then installed on compromised websites. The injected code is used to funnel unsuspecting visitors through traffic redirection chains, with the reported outcome including fraudulent tech support scam pages. The report cites over 20,000 domains hosted on Cloudflare Pages as part of the infrastructure involved.

Why It Matters for Defenders

TDS-based scam infrastructure like this abuses legitimate, trusted hosting platforms (in this case Cloudflare Pages) to distribute malicious or fraudulent content, which can make domain-reputation-based blocking less effective and complicates takedown efforts. Because the PHP templates are installed into compromised websites rather than attacker-owned infrastructure alone, any organization running a vulnerable or poorly maintained CMS/web application is a potential unwitting host for traffic redirection — not just an end-user target. The scale reported (20,000+ domains) also suggests a mature, long-lived affiliate ecosystem rather than a one-off campaign, meaning this infrastructure is likely to persist and evolve rather than disappear quickly.

What Defenders Should Watch For

• Unexpected or anomalous outbound redirects from internally hosted or managed websites, particularly multi-hop redirect chains ending in tech-support-scam-style landing pages.
• Unauthorized PHP files or modified templates appearing in web roots, especially on CMS platforms (a common injection vector for TDS redirect code).
• Traffic to or from newly registered / rapidly rotating subdomains on shared hosting platforms, including Cloudflare Pages, that correlate with redirect behavior.
• Web server and CDN logs showing referrer or user-agent patterns consistent with TDS gating logic (e.g., filtering by geography, device, or browser before redirecting).
• Routine integrity monitoring and patching of public-facing web applications to reduce the chance of being used as an unwitting redirect host.

At this stage, no specific malware family, CVE, or targeted sector has been detailed in the available reporting — defenders should treat these as general hunting angles rather than confirmed indicators.

Developing Intel

This is net-new reporting on an ongoing campaign/infrastructure, and attribution details (including the Hotejka/ROI777 link) are based on researcher assessment rather than confirmed facts. We will continue to track this story as more details emerge. Read the original report at The Hacker News.