Help TDS Routes 20,000+ Cloudflare Pages Domains to Hotejka Tech Support Scams, Evolving from 2017 ROI777 Precursor
A persistent Russian-linked TDS has repurposed 20,000 Cloudflare Pages domains for tech support scams since 2017, rebranding from ROI777 after its 2018 exposure. Evidence from Infoblox, GoDaddy, and Guardicore documents the plugin-based compromise chain and affiliate handoffs. The infrastructure filters and routes traffic to remote-access fraud operations with minimal changes despite prior leaks.
The operation filters visitors through browser fingerprinting before routing to full-screen browser lockers that push fake Microsoft alerts and remote access tools. Infoblox traced the infrastructure to Hotejka, a rebrand of ROI777, which Guardicore documented in 2018 during Operation Prowli for cryptocurrency mining and traffic monetization on compromised CMS servers. GoDaddy's August 2025 analysis identified the malicious plugin fetching C2 redirect URLs, confirming historical roi777.com domains used until 2020.
Infoblox: Help TDS will add 4,000 new Cloudflare Pages domains to its redirect pool by March 2026 unless C2 domains are sinkholed.
Sources (3)
- [1]Infoblox Report on Help TDS(https://www.infoblox.com/resources/reports/help-tds-hotejka/)
- [2]GoDaddy Security Blog August 2025(https://www.godaddy.com/resources/news/woocommerce-inputs-plugin)
- [3]Guardicore Labs Operation Prowli(https://www.guardicore.com/blog/operation-prowli/)