Infoblox traces Help TDS tech support scams to Hotejka, an apparent ROI777 rebrand
Infoblox ties the Help TDS traffic distribution system, active since at least 2017, to a Russian-language affiliate program called Hotejka. The Hacker News reports the scams run on more than 20,000 Cloudflare Pages domains and aim to put remote desktop tools on victims' machines.
The Watch · Security desk
Timeline: March 2018, a leak of data from ROI777's servers exposes users' Telegram identities and is believed to drive the rebrand; June 2018, Guardicore Labs exposes ROI777 in connection with Operation Prowli; August 2025, GoDaddy documents Help TDS's evolution.
| Date | Event | Claim |
|---|---|---|
| March 2018 | ROI777 server data leaks; believed to drive the rebrand | 9 |
| June 2018 | Guardicore Labs exposes ROI777 over Operation Prowli | 8 |
| August 2025 | GoDaddy documents Help TDS's evolution | 6 |
What happened
- Help TDS supplies PHP code templates to partners and affiliates, who install them in compromised websites to push visitors toward tech support scams.
- The scam pages use full-screen browser manipulation and exit prevention to show fake Windows security alerts that tell victims to call a support number.
- Data from ROI777's servers leaked in March 2018, exposing user Telegram identities and campaign details, and the rebrand is believed to follow from that leak.
- GoDaddy found roi777[.]com among the historical C2 domains used between 2018 and 2020 to fetch redirect domains.
- Help TDS has routinely handed traffic straight to VexTrio Viper, an operator that runs an affiliate program for scams, riskware, spyware, adware and pornography.
Why it matters
- exposure A victim who installs the remote tool is open to repeat exploitation. Reversing a card charge does not end the incident. The tool has to come off the machine.
- constraint The TDS screens on location, IP reputation and headless browsers, so a crawler or sandbox does not necessarily see the page a target victim sees.
- precedent The operation has outlived a leak of its own data and a public write-up of its tooling. We would expect any domain blocklist of today's lures to age fast.
Hotejka is the front door. Its affiliates range from spam operators to website compromisers [11]. They send victims in through special URLs, and the TDS does the sorting. In Infoblox's words: "Potential victims are redirected into the TDS from these affiliates via special URLs provided by Hotejka. The TDS then evaluates the user via browser fingerprinting and location to determine the course of action." [12]
A TDS of this kind filters on geography, device metadata, IP reputation and headless browsers, then routes each visitor to a scam, a browser locker or a malware drop [13]. Infoblox calls Help TDS and its precursors "the routing decision infrastructure for a small affiliate program" [16]. The Hacker News reports it is believed to run on Keitaro, an advertising performance tracking platform that various threat actors abuse [14].
On the compromised-site side, GoDaddy documented the TDS's tooling in August 2025. A malicious WordPress plugin named "woocommerce_inputs" sat on thousands of sites, stole WordPress user credentials and fetched redirect URLs from command-and-control servers. Affiliates inject either the plugin or a custom HTML block [6]. In our view, fetching URLs from a C2 server lets the operator change destinations without touching the compromised site.
The payoff comes after the phone call. "Help TDS delivers tech support scams (TSSs) that direct users to call centers, where social engineering is used to convince them to install remote desktop tools," Infoblox said in a report shared with The Hacker News [4]. It added: "It's not simple credit card fraud: it's remote access, living-off-the-land malware operations. Once in, the threat actor can exploit the victim time and again." [5]
The lineage is older than the brand. Guardicore Labs, now part of Akamai, exposed ROI777 in June 2018 in connection with Operation Prowli, in which compromised servers ran r2r2 malware to mine cryptocurrency [8]. Guardicore described the business model at the time: "Traffic monetizers, such as ROI777, buy traffic from 'website operators' such as the Prowli attackers and redirect it to domains on demand." [15]
The Hacker News describes the Hotejka-to-ROI777 link as a suspected succession, and it calls Hotejka an apparent rebrand [17]. The 20,000-domain figure comes from The Hacker News's headline on Infoblox's findings [1]. None of Infoblox's quoted statements puts a number on victims or losses.
What to watch
- Whether Infoblox or Cloudflare publishes the list of Pages domains behind the 20,000 figure, and whether those domains are taken down.
- Whether further evidence ties Hotejka to ROI777 beyond the 2018 leak and the roi777[.]com C2 domain.
- Whether Help TDS keeps handing traffic to VexTrio Viper in newly observed redirect chains.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption50
- Hype gap+10
- Incentives45
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Hacker News headline reports that more than 20,000 Cloudflare Pages domains host tech support scams linked to Help TDS and Hotejka.
- [2]
Help TDS offers PHP code templates to partners and affiliates that are installed into compromised websites to direct users to tech support scams; it is assessed to be active since at least 2017.
- [3]
The tech support scams use full-screen browser manipulation and exit prevention techniques to serve bogus Microsoft Windows security alert screens that tell victims to contact a Windows Support number.
- [4]
"Help TDS delivers tech support scams (TSSs) that direct users to call centers, where social engineering is used to convince them to install remote desktop tools," Infoblox said in a report shared with The Hacker News.
- [5]
Infoblox said: "It's not simple credit card fraud: it's remote access, living-off-the-land malware operations. Once in, the threat actor can exploit the victim time and again."
- [6]
GoDaddy documented Help TDS's evolution in August 2025, including a malicious WordPress plugin named "woocommerce_inputs" on thousands of websites that steals WordPress user credentials and fetches redirect URLs from C2 servers; the plugin, or a custom HTML block, is injected into sites by Hotejka's affiliates.
- [7]
Historical tracking of redirect chains shows Help TDS has routinely handed off traffic directly to VexTrio Viper, a cybercrime operator running an affiliate program for scams, riskware, spyware, adware and pornographic content.
- [8]
Guardicore Labs (now part of Akamai) exposed ROI777 in June 2018 in connection with Operation Prowli, a traffic manipulation and cryptocurrency mining campaign in which compromised servers were used to deploy r2r2 malware to mine cryptocurrency.
- [9]
The rebrand is believed to be driven by a leak of data from ROI777's servers in March 2018, around when it was operating Disposable TDS, a precursor to Help TDS; the published details included Telegram identities of users and details of multiple campaigns.
- [10]
GoDaddy found that "roi777[.]com" is one of the historical C2 domains used between 2018 and 2020 to fetch the redirect domains.
- [11]
Hotejka's affiliates range from spam operators to website compromisers, Infoblox said.
- [12]
Infoblox said: "Potential victims are redirected into the TDS from these affiliates via special URLs provided by Hotejka. The TDS then evaluates the user via browser fingerprinting and location to determine the course of action."
- [13]
A TDS intercepts traffic from compromised websites, malicious ads, social media posts or SEO spam, filters it on criteria such as geographic location, device metadata, IP reputation and headless browsers, and routes visitors to scams, browser lockers or malware drops.
- [14]
The TDS is believed to be implemented on Keitaro, an advertising performance tracking platform known to be abused by various threat actors.
- [15]
Guardicore Labs noted at the time: "Traffic monetizers, such as ROI777, buy traffic from 'website operators' such as the Prowli attackers and redirect it to domains on demand."
- [16]
Infoblox explained: "Help TDS and its precursors are the routing decision infrastructure for a small affiliate program."
- [17]
Hotejka appears to be a rebrand of the traffic monetization operation ROI777 and is suspected to be its successor.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- thehackernews.comHelp TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Tech support scamsFollow
- Threat Intelligence and Incident ResponseFollow
- Traffic Distribution SystemsFollow