As reported by The Hacker News, the long-running Traffic Distribution System (TDS) known as Help TDS has been linked to the Russian-language affiliate program Hotejka, with over 20,000 Cloudflare Pages domains now identified as hosting tech support scam infrastructure. The operation, active since at least 2017, represents a persistent and industrialized threat that continues to evolve.

Threat Alert: The operation, active since at least 2017, represents a persistent and industrialized threat that continues to evolve.

What makes this story significant is not the tech support scam itself — that's a well-known attack vector — but the supply chain maturity behind it. Help TDS operates as a layered ecosystem: affiliates compromise legitimate WordPress sites, inject malicious plugins or HTML blocks, and then redirect traffic through a TDS that routes victims to scam call centers. The revelation that Hotejka is likely a rebrand of ROI777 — exposed by Guardicore Labs in 2018 during Operation Prowli — demonstrates how threat actors survive exposure by simply rebranding rather than disbanding.

Why This Matters

The abuse of Cloudflare Pages at this scale is a critical development. Threat actors are leveraging legitimate serverless hosting platforms to rapidly deploy thousands of scam domains, benefiting from Cloudflare's reputation and infrastructure to evade traditional domain-based blocking. When scams are served from infrastructure associated with a trusted CDN, security gateways that rely on domain reputation are significantly less effective.

The core issue is that legitimate platforms — Cloudflare Pages, WordPress plugin ecosystems, and CMS deployments — are being systematically weaponized. Defenders cannot simply block the hosting provider without massive collateral damage.

The connection to VexTrio Viper, a known cybercrime affiliate operator, further illustrates that Help TDS is not an isolated operation. It functions as a node in a broader criminal ecosystem where traffic is bought, sold, and routed to whichever monetization scheme is most profitable at any given moment.

Who Is at Risk

Why This Matters
WordPress site operators — particularly those running outdated CMS versions or poorly maintained plugin ecosystems. The woocommerce_inputs plugin identified by GoDaddy in 2025 is a prime example of how legitimate-looking plugins serve as injection vectors.
End users — especially less technical users who are susceptible to full-screen browser lockup techniques and fake Windows security alerts.
Enterprises — compromised sites in an organization's domain can damage brand trust and serve as initial access vectors if employees encounter scams on company-managed devices.

Broader Implications

The rebrand from ROI777 to Hotejka highlights a structural weakness in how the security community tracks threat actors. Public exposure and data leaks may temporarily disrupt operations, but without sustained law enforcement action or infrastructure takedowns, actors simply rebrand and continue. The 2018 data leak from ROI777's servers disrupted the operation temporarily — but the entity re-emerged as Hotejka and has now scaled to over 20,000 domains.

Additionally, the use of Cloudflare Pages raises important questions about platform responsibility. Serverless and static hosting platforms are increasingly attractive to threat actors because they offer free tiers, rapid deployment, and the ability to generate disposable domains at scale. Platforms must invest in proactive abuse detection rather than relying solely on reactive takedown requests.

Shield53 Recommendations

  • Audit WordPress installations for unexpected plugins, particularly woocommerce_inputs or any plugin not installed by an authorized administrator. Review installed plugins against official WordPress plugin repository listings.
  • Implement browser security controls that detect and block full-screen takeover attempts and JavaScript-based exit prevention. Modern EDR solutions with web content filtering can intercept these techniques before the user sees the fake alert.
  • Deploy DNS-based threat intelligence that incorporates real-time TDS infrastructure feeds. Blocking known TDS redirect domains upstream prevents the traffic from ever reaching the scam endpoint.
  • User awareness training should specifically address tech support scam tactics — full-screen pop-ups, fake Windows alerts, and instructions to call support numbers. Reinforce that legitimate Microsoft or OS error messages never include phone numbers.
  • Monitor for credential theft on compromised CMS sites. The Help TDS plugin actively exfiltrates WordPress credentials, which can lead to deeper compromise. Rotate CMS admin credentials regularly and enforce MFA where supported.
  • For platform providers: invest in automated abuse detection for static hosting services. Pattern-based detection for mass domain registration, identical site templates, and known scam content signatures should trigger automatic review.

Help TDS has survived for nearly a decade by adapting its infrastructure and rebranding when exposed. Disrupting operations of this scale requires coordinated action across hosting providers, threat intelligence sharing, and sustained takedown efforts — not just individual site remediation.