Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams

The Help TDS operation, active since at least 2017, demonstrates how long-lived cybercriminal affiliate networks can persist by compromising legitimate websites and abusing trusted platforms like Cloudflare Pages to evade detection. Attackers install PHP redirect templates on vulnerable or poorly maintained websites, silently funneling unsuspecting users to tech support scam pages — a tactic that exploits both website owner negligence and end-user trust in familiar domains. The sheer scale of 20,000+ malicious domains highlights how traffic distribution systems can industrialize fraud with minimal cost to attackers. This matters because compromised legitimate sites damage the reputation of innocent website owners while providing cover for criminal activity. End users are especially at risk because the redirect chain obscures the malicious origin, making it harder for both humans and security tools to detect the threat.