Help TDS sends WordPress visitors to tech support scams
Tech support scams delivered through Help TDS have used compromised WordPress websites and more than 20,000 Cloudflare Pages domains to reach potential victims. Infoblox links the long-running Traffic Distribution System (TDS), infrastructure that sorts visitors and sends them to selected destinations, to the Russian-language Hotejka affiliate program. Hotejka is suspected of being a renamed version of the earlier ROI777 traffic monetization operation. Help TDS is assessed to have operated since at least 2017.
According to Infoblox, affiliates receive special URLs and PHP code templates, pieces of server-side website code, that can be placed on compromised sites. The TDS examines each visitor through browser fingerprinting and location data, then decides where to send that person. Its filters can consider geographic location, device details, IP address reputation and whether the visit comes from a headless browser, an automated browser without a normal visible window. Traffic may originate from compromised sites, malicious advertisements, social media posts or search engine optimization (SEO) spam designed to manipulate search results. Help TDS is believed to run on Keitaro, an advertising performance tracking platform that has also been abused by threat actors.
Visitors selected for tech support scams can be shown a full-screen page that is difficult to close. The page may first claim that a Windows update is imminent, then state that Microsoft has disabled the computer. Other messages tell the user not to restart, allege illegal activity and claim that a computer restriction has been imposed. The objective is to make the victim telephone a purported Microsoft support number. If the call is made, the person answering attempts to persuade the victim to install a free remote desktop application such as Ultraviewer, which allows another person to control the computer remotely. Infoblox warns that this access can support repeated exploitation rather than a single payment-card theft.
Not every visitor is necessarily sent to the phone scam. Infoblox found that Help TDS can instead pass traffic to another affiliate marketing platform, where the device is evaluated again and the visit is resold. Some of those routes finish at scam pages presenting fake CAPTCHA checks, which imitate tests used to distinguish people from automated programs. The pages try to persuade users to allow browser notifications, enabling subsequent push-notification spam.
Compromised WordPress sites are an important part of the delivery chain. In August 2025, GoDaddy documented a malicious WordPress plugin called woocommerce_inputs on thousands of sites. It was designed to steal WordPress user credentials and retrieve redirection addresses from command-and-control (C2) servers, which are systems used to provide instructions or destinations to malicious code. GoDaddy reported that Hotejka affiliates inserted either the plugin or a custom HTML block into affected websites. In recent years, Hotejka has also appeared under different names on CrackingX, seeking email-spam traffic and access to WordPress administrator accounts for prices starting at $100.
Infoblox identified about 20 affiliates sending visitors to Help TDS, including Balada Injector, Detour Dog and DollyWay. These operations are known for heavily targeting WordPress websites to redirect visitors to scams and malware. Historical redirect chains also show Help TDS passing traffic directly to VexTrio Viper, an affiliate-based cybercrime operation associated with scams, unwanted software, spyware, advertising software and pornographic content.
The suspected lineage extends back to ROI777 and Operation Prowli, a campaign disclosed by Guardicore Labs in June 2018. That activity compromised vulnerable servers, deployed malware called r2r2 and used the systems to mine cryptocurrency. WordPress installations and servers running other content management systems (CMS), software used to create and operate websites, were also exploited for traffic monetization. In that arrangement, website operators supplied visitors to ROI777 and received payment for the traffic, while destination sites offered scams, fake services and malicious browser extensions.
A March 2018 leak of information taken from ROI777 servers exposed Telegram identities and campaign details. The disclosure is believed to have contributed to a rebrand around the period when Disposable TDS, described as a precursor to Help TDS, was operating. GoDaddy also found that roi777[.]com served as a historical C2 domain between 2018 and 2020. Infoblox says historical Domain Name System (DNS) records, recurring use of the same affiliate advertising platforms and consistent C2 methods provide a high degree of confidence that ROI777 and Hotejka are the same operation.
Since April 2026, the scams have used free Cloudflare Pages sites under the pages[.]dev domain, with roughly 300 disposable pages created each day and more than 20,000 detected in total. A Hotejka Telegram post dated July 17, 2026 claimed that a small call center in Germany would process 50 to 100 calls daily. Other posts promoted forced browser-extension installations and support pages designed to resist attempts to leave. Using eight years of observed DNS volumes, affiliate identifiers and commonly reported advertising payouts, Infoblox suspects that two European affiliate programs paid the operation at least a few million US dollars, although that figure is an assessment rather than a confirmed total.
For website owners, the findings show how stolen administrator access or injected WordPress code can turn an otherwise legitimate site into the first step of a scam without placing the final page on that site. Owners should treat unfamiliar plugins, administrator accounts, HTML blocks and unexplained redirects as potential signs of compromise. For those considering managed operations, AEU Hosting offers managed WordPress hosting, secured end to end. Visitors who encounter a full-screen security warning should avoid calling the displayed number or installing remote-control software at the caller's request.