{
  "id": 14722391,
  "title": "Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams",
  "url": "https://urgent.news/2026/10/15/help-tds-linked-to-hotejka-as-20-000-cloudflare-pages-domains-host",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-15T14:11:36.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/10/help-tds-linked-to-hotejka-as-20000.html"
  },
  "original_language": "en",
  "account": "Help TDS, a long-running traffic distribution system linked to Hotejka, is being investigated for hosting tech support scams. The system has been active since at least 2017 and offers PHP code templates to partners and affiliates that are installed into compromised websites. These templates aim to direct users to bogus Microsoft Windows security alert screens, instructing them to contact a Windows Support number to address the problem. The scams are delivered using full-screen browser manipulation and exit prevention techniques. Help TDS has evolved over time, with its most recent connection to Hotejka, which is believed to be a successor to ROI777, a traffic manipulation and cryptocurrency mining campaign. Hotejka's affiliates include spam operators and website compromisers, who redirect users to the TDS via special URLs. The TDS then evaluates the user and routes them to the appropriate scam, whether it be a tech support scam or another affiliate marketing platform. Over 20,000 Cloudflare Pages domains have been detected as part of this scheme.",
  "summary": "A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active since at least 2017, offering PHP code templates to partners and affiliates that are installed into compromised websites with an aim to direct unsuspecting",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}