{
  "id": 18972023,
  "title": "Cloudflare Pages Abuse at Scale: Measuring Help TDS Without Overclaiming",
  "url": "https://urgent.news/2026/11/08/cloudflare-pages-abuse-at-scale-measuring-help-tds-without",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-08T16:24:06.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ioneyrezende/cloudflare-pages-abuse-at-scale-measuring-help-tds-without-overclaiming-2kj0"
  },
  "original_language": "en",
  "account": "Cloudflare Pages is a platform designed to simplify web application deployment. However, its ease of use has attracted malicious actors seeking to create numerous short-lived web pages for scams. Infoblox reports that Help TDS, a scam operator, has been using free pages.dev sites since April 2026, generating hundreds of new Pages sites daily. This abuse problem is specific to the legitimate Cloudflare Pages platform, not an endorsement or operation by Cloudflare itself.\n\nTo accurately measure the scale of abuse, three questions must be addressed: the size of the Pages platform, the number of Pages pages containing scam-related terms, and the number of pages attributable to Help TDS. The answers reveal that the platform is vast, with over 125,000 new pages.dev subdomains created daily. The actors involved create about 300 sites per day, with most domains lasting only one week. They employ multiple naming conventions and may display decoy pages when scanned directly.\n\nInfoblox has detected approximately 30,000 domains associated with the actor by mid-September, with only about 16,000 of these announced on the Telegram channel. The model identified some domains about seven days before they were used. These facts demonstrate that a blanket approach of assuming all Pages sites are suspect is not effective. Legitimate Pages sites far outnumber the actor's sites, and the actor can choose names that overlap with ordinary naming patterns.\n\nPublic pages on Pages can be discovered using brand-related body strings, but this does not indicate malicious intent, actor ownership, or user redirection. A generic query like \"Microsoft\" returned 61 observations through a public search, while a more targeted query for a specific WordPress fingerprint and redirect marker returned 207 observations. While the latter count is more defensible as a potential Help TDS-related candidate, it still does not prove actor control of each website.\n\nCloudflare provides an abuse reporting process, requiring specific URLs, descriptions of observed content, access times, and evidence of prohibited activities. Reports should not claim that every Pages domain is part of Help TDS, as this would be an overclaim. Instead, the report should identify individual pages and the evidence connecting them to the scam. Cloudflare cannot investigate a generic hosting platform based on brand keywords; it must receive specific evidence from the reporting party.\n\nAttribution to the actor requires specific evidence from the actor themselves, such as Telegram announcements, domain-generation analysis, DNS history, decoy pages, named domains, affiliate codes, and relationships to prior infrastructure. While public body matches can confirm a page contains a specific string, they cannot establish why a particular page was created or who controls the account behind it. A high-confidence actor domain can justify blocking and investigation, while a generic brand match may only warrant a queue item.",
  "summary": "Cloudflare Pages Abuse at Scale: Measuring Help TDS Without Overclaiming Cloudflare Pages is designed to make deployment easy. That ease is also attractive to criminals who need many short-lived web pages. Infoblox reports that Help TDS has used free pages.dev sites since April 2026 and creates hundreds of new Pages sites per day. The case is an abuse problem on a legitimate platform, not…",
  "key_points": [
    "Cloudflare Pages attracts malicious actors creating hundreds of new Pages sites daily for scams",
    "Infoblox detected approximately 30,000 domains associated with Help TDS by mid-September",
    "Cloudflare provides an abuse reporting process requiring specific URLs, evidence, and descriptions"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}