www.infoblox.com Help TDS Linked to Hotejka; 20,000+ Domains Host Tech Support Scams
Article Content
- •Help TDS has been active since 2017, directing users to tech support scams.
- •Over 20,000 Cloudflare Pages domains are reportedly involved in these scams.
- •Hotejka is linked to ROI777, which was exposed for similar activities in 2018.
Help TDS, a long-running Traffic Distribution System linked to the Russian-language affiliate program Hotejka, has been active since at least 2017. It directs users to tech support scams through compromised websites that utilize browser manipulation techniques. Victims are led to call centers where they are coerced into installing remote access tools. The TDS has been documented to use a malicious WordPress plugin for credential theft and redirection. Hotejka is believed to be a rebrand of ROI777, which was previously exposed for similar activities in 2018. The latest findings indicate that over 20,000 Cloudflare Pages domains are involved in these scams. The operation has evolved over time, leveraging various tactics to evade detection. The connection to ROI777 suggests a continuity of malicious practices in traffic monetization fraud.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track R2r2 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What is Help TDS?
How are victims targeted?
What should organizations do to protect themselves?
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…