Help TDS & Hotejka Exploit 20,000+ Cloudflare Pages Domains for Tech Support Scams
The Help TDS operation, active since at least 2017, demonstrates how long-lived cybercriminal affiliate networks can persist by compromising legitimate websites and abusing trusted platforms like Cloudflare Pages to evade detection. Attackers install PHP redirect templates on vulnerable or poorly maintained websites, silently funneling unsuspecting users to tech support scam pages — a tactic that exploits both website owner negligence and end-user trust in familiar domains. The sheer scale of 20,000+ malicious domains highlights how traffic distribution systems can industrialize fraud with minimal cost to attackers. This matters because compromised legitimate sites damage the reputation of innocent website owners while providing cover for criminal activity. End users are especially at risk because the redirect chain obscures the malicious origin, making it harder for both humans and security tools to detect the threat.
Tactical Insight
Immediate actions
- Audit all public-facing websites for unauthorized PHP files, unexpected redirects, or injected scripts using integrity monitoring tools.
- Report and request takedown of identified malicious Cloudflare Pages domains through Cloudflare's abuse reporting process.
- Notify end users and employees to be skeptical of unsolicited browser alerts or pop-ups urging them to call a support number.
Long-term improvements
- Implement a Web Application Firewall (WAF) and regularly patch all CMS platforms (WordPress, Joomla, etc.) and their plugins to eliminate footholds used by TDS operators.
- Establish a formal vulnerability management program that continuously scans internet-facing assets for known weaknesses and misconfigurations.
- Enforce least-privilege access to hosting environments and require multi-factor authentication for all CMS and hosting control panel accounts.
Detection measures
- Deploy DNS-layer security and web proxy filtering to detect and block known TDS infrastructure and suspicious redirect chains before they reach end users.
- Monitor web server logs for anomalous redirect patterns, unexpected outbound requests, or spikes in PHP file modifications as indicators of TDS installation.
- Integrate threat intelligence feeds containing known Help TDS / Hotejka indicators of compromise (IOCs) into SIEM and endpoint detection tools.