Hexa Tiger 
Scale My Publication 
SEO for Public Figures 
The report links Help TDS to Hotejka and says more than 20,000 Cloudflare Pages domains hosted tech support scams since April 2026, according to The Hacker News, citing Infoblox. The source headline, “Help TDS Linked to Hotejka,” captures that connection. The activity involves a traffic distribution system active since at least 2017 and a Russian-language affiliate program suspected of succeeding ROI777.
The operators create roughly 300 disposable Pages sites each day, Infoblox said. The sites feed a broader operation that redirects visitors from compromised websites to support scams, notification spam or other affiliate destinations.
Help TDS Linked Through Redirect Infrastructure
Help TDS functions as routing infrastructure for affiliates. It receives visitors through specially crafted links, then uses browser fingerprinting and location data to decide where each person goes. Infoblox said affiliates include spam operators and website compromisers.
The traffic often begins on compromised sites. Hotejka affiliates install PHP code templates on those sites, or add a custom HTML block, to trigger malicious redirects. GoDaddy documented the use of a WordPress plugin called “woocommerce_inputs” in August 2025. The plugin stole WordPress credentials and fetched redirect URLs from command-and-control servers.
That history adds a connection to Cloudflare Pages infrastructure, which the company has also used to route traffic during its own blog migration. The situations differ: the current report describes criminal abuse of free Pages sites, while the earlier article covered Cloudflare’s migration process.
Fake Windows Alerts Lead to Remote Access
Some lures claim a Windows update is pending, then display a warning that Microsoft has disabled the computer. The pages tell visitors not to restart and claim a “computer lock” prevents illegal activity. They urge victims to call a supposed Microsoft support number.
Infoblox said callers are directed to install remote desktop software such as UltraViewer, giving the operators control of the machine. The company described the risk as more than payment fraud: remote access can allow an attacker to exploit a victim repeatedly.
A visitor’s device and location help determine whether the TDS shows a support scam or sends the visitor to another affiliate platform. Some routes end at fake CAPTCHA pages that try to enroll browsers in push-notification spam. Historical redirects have also led to VexTrio Viper, an operator whose affiliate program handles scams, riskware, spyware, adware and pornographic content.
The use of free Pages domains sits alongside other cloud-platform security concerns, including a previously reported Cloudflare Containers vulnerability. That separate issue involved possible access to leftover disk data between customers; it is not linked in the source to Help TDS.
Infoblox Connects Hotejka to ROI777
Infoblox said historical DNS records, affiliate identifiers and recurring command-and-control methods support its assessment that Hotejka and ROI777 are the same operation. This evidence underpins the report’s “Help TDS Linked to Hotejka” description. GoDaddy found that roi777[.]com appeared among historical command-and-control domains used from 2018 to 2020.
ROI777 was exposed in 2018 in connection with Operation Prowli, a campaign involving compromised servers and cryptocurrency mining malware. Guardicore Labs described traffic monetizers as buying visits from compromised-site operators and redirecting them to destinations that could change on demand. The report says the leaked ROI777 data in March 2018 may have prompted the later rebrand.
Infoblox estimates about 20 affiliates send traffic to Help TDS, including Balada Injector, Detour Dog and DollyWay. It also suspects the two European programs paid affiliates at least a few million dollars, based on eight years of DNS volumes, affiliate identifiers and commonly cited advertising payouts. The separate role of content delivery networks in WordPress performance illustrates the legitimate infrastructure context that makes scrutiny of platform abuse relevant.
The report’s “Help TDS Linked to Hotejka” finding rests on historical DNS records, affiliate identifiers and recurring command-and-control methods. Infoblox says the scam pages have appeared on free Cloudflare Pages domains since April 2026, keeping those domains and redirect chains in its current tracking picture.
