Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams
Summary
A long-running Traffic Distribution System (TDS) named Help TDS, linked to the Russian-language affiliate program Hotejka, is reportedly directing over 20,000 Cloudflare Pages domains to host tech support scams. This operation has been active since at least 2017, distributing PHP code templates to affiliates for use on compromised websites.
IFF Assessment
The operation is facilitating tech support scams, which are a significant threat to individuals and organizations, leading to financial loss and potential compromise.
Defender Context
This report highlights the continued exploitation of legitimate services like Cloudflare Pages by malicious actors for hosting scam operations. Defenders should be aware of evolving TDS techniques used to distribute malicious traffic and the potential for compromised websites to serve as vectors for these scams.