Cloudflare Pages Abuse at Scale: Measuring Help TDS Without Overclaiming

Cloudflare Pages is a platform designed to simplify web application deployment. However, its ease of use has attracted malicious actors seeking to create numerous short-lived web pages for scams. Infoblox reports that Help TDS, a scam operator, has been using free pages.dev sites since April 2026, generating hundreds of new Pages sites daily. This abuse problem is specific to the legitimate Cloudflare Pages platform, not an endorsement or operation by Cloudflare itself.

To accurately measure the scale of abuse, three questions must be addressed: the size of the Pages platform, the number of Pages pages containing scam-related terms, and the number of pages attributable to Help TDS. The answers reveal that the platform is vast, with over 125,000 new pages.dev subdomains created daily. The actors involved create about 300 sites per day, with most domains lasting only one week. They employ multiple naming conventions and may display decoy pages when scanned directly.

Infoblox has detected approximately 30,000 domains associated with the actor by mid-September, with only about 16,000 of these announced on the Telegram channel. The model identified some domains about seven days before they were used. These facts demonstrate that a blanket approach of assuming all Pages sites are suspect is not effective. Legitimate Pages sites far outnumber the actor's sites, and the actor can choose names that overlap with ordinary naming patterns.

Public pages on Pages can be discovered using brand-related body strings, but this does not indicate malicious intent, actor ownership, or user redirection. A generic query like "Microsoft" returned 61 observations through a public search, while a more targeted query for a specific WordPress fingerprint and redirect marker returned 207 observations. While the latter count is more defensible as a potential Help TDS-related candidate, it still does not prove actor control of each website.

Cloudflare provides an abuse reporting process, requiring specific URLs, descriptions of observed content, access times, and evidence of prohibited activities. Reports should not claim that every Pages domain is part of Help TDS, as this would be an overclaim. Instead, the report should identify individual pages and the evidence connecting them to the scam. Cloudflare cannot investigate a generic hosting platform based on brand keywords; it must receive specific evidence from the reporting party.

Attribution to the actor requires specific evidence from the actor themselves, such as Telegram announcements, domain-generation analysis, DNS history, decoy pages, named domains, affiliate codes, and relationships to prior infrastructure. While public body matches can confirm a page contains a specific string, they cannot establish why a particular page was created or who controls the account behind it.

A high-confidence actor domain can justify blocking and investigation, while a generic brand match may only warrant a queue item.