[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvE7Etlx1Ny9OwDl6athoD4vgEIEKKBNdVNwCXbRpGzQ":3},{"article":4,"iocs":46,"watch_terms":49,"solutions":50,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"96af03fc-9955-47fc-8680-a83945b639d3","Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams","help-tds-linked-to-hotejka-as-20-000-cloudflare-pages-domains-host-tech-support--3d53c1","A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation dubbed ROI777. Help TDS is assessed to be active since at least 2017, offering PHP code templates to partners and affiliates that are installed into compromised websites with an aim to direct unsuspecting","A long-running Traffic Distribution System (TDS) known as Help TDS has been linked to a Russian-language affiliate program called Hotejka, which is likely a rebrand of the ROI777 operation. Help TDS has been active since at least 2017, providing PHP code templates to affiliates. These templates are installed on compromised websites to redirect unsuspecting users to tech support scams, with over 20,000 Cloudflare Pages domains identified as hosting these malicious redirects.","Help TDS linked to Hotejka, hosting tech support scams on 20,000+ Cloudflare Pages domains.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fhelp-tds-linked-to-hotejka-as-20000.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgp2enQeK-5xZuEo_rLQje9W_odynVLALJCEvTyaMSolIfwVonZGMceQWA8yq9xPMD-C_RkIp-V03EqEBVTM5yMq9IHWRRfSHxWWDS6kCJVcVAsmlFXt5wD2pK7Bk-A6iBIDFS2o811n8e48B1Psni_qvrkJ0HMXtJlhaLwx7jkxEG-e0XDgtcAMUMLiNFV\u002Fs1600\u002Fhot.jpg","2026-10-15T14:11:36+00:00","2026-10-15T16:00:13.64907+00:00",7,[17,20,23,25],{"name":18,"type":19},"Help TDS","threat_actor",{"name":21,"type":22},"Hotejka","campaign",{"name":24,"type":22},"ROI777",{"name":26,"type":27},"Cloudflare Pages","product","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":28,"icon":30,"name":31,"slug":32},null,"Threat Intelligence","threat-intelligence",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},[47],{"type":43,"value":18,"context":48},"Traffic Distribution System used for tech support scams",[26],{"controls":51,"vendors":135},[52,81,109],{"slug":53,"name":54,"problem":55,"products":56},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xpanse","Cortex Xpanse","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xpanse","External attack surface discovery and remediation.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","attack-surface-intelligence","Attack Surface Intelligence","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fattack-surface-intelligence","External attack surface management that discovers internet-facing assets and prioritises their exposures.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":32,"name":82,"problem":83,"products":84},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"slug":110,"name":111,"problem":112,"products":113},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":131,"product_name":132,"url":133,"description":134},"prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",[],{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":151},"help-tds-hotejka-exploit-20000-cloudflare-pages-domains-for-tech-support-scams","Help TDS & Hotejka Exploit 20,000+ Cloudflare Pages Domains for Tech Support Scams","The Help TDS operation, active since at least 2017, demonstrates how long-lived cybercriminal affiliate networks can persist by compromising legitimate websites and abusing trusted platforms like Cloudflare Pages to evade detection. Attackers install PHP redirect templates on vulnerable or poorly maintained websites, silently funneling unsuspecting users to tech support scam pages — a tactic that exploits both website owner negligence and end-user trust in familiar domains. The sheer scale of 20,000+ malicious domains highlights how traffic distribution systems can industrialize fraud with minimal cost to attackers. This matters because compromised legitimate sites damage the reputation of innocent website owners while providing cover for criminal activity. End users are especially at risk because the redirect chain obscures the malicious origin, making it harder for both humans and security tools to detect the threat.",[141,142,143,144,145,146,147,148,149,150],"CIS Control 7: Continuous Vulnerability Management","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SI-4: Information System Monitoring","NIST SP 800-53 RA-5: Vulnerability Scanning","NIST CSF DE.CM-7: Monitoring for Unauthorized Activity","NIST CSF PR.AT-1: Security Awareness Training","OWASP Top 10 A05: Security Misconfiguration","GDPR Article 32: Security of Processing (for EU-based website operators hosting compromised assets)",{}]