Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams
A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active since at least 2017, offering PHP code templates to partners and affiliates that are installed into compromised websites with an aim to direct unsuspecting
Help TDS, a long-running traffic distribution system linked to Hotejka, is being investigated for hosting tech support scams. The system has been active since at least 2017 and offers PHP code templates to partners and affiliates that are installed into compromised websites. These templates aim to direct users to bogus Microsoft Windows security alert screens, instructing them to contact a Windows Support number to address the problem.
The scams are delivered using full-screen browser manipulation and exit prevention techniques. Help TDS has evolved over time, with its most recent connection to Hotejka, which is believed to be a successor to ROI777, a traffic manipulation and cryptocurrency mining campaign. Hotejka's affiliates include spam operators and website compromisers, who redirect users to the TDS via special URLs.
The TDS then evaluates the user and routes them to the appropriate scam, whether it be a tech support scam or another affiliate marketing platform. Over 20,000 Cloudflare Pages domains have been detected as part of this scheme.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
