1. Executive summary
A long-running traffic distribution system tracked as Help TDS has been linked to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a traffic monetization operation previously tracked as ROI777. Help TDS has been active since at least 2017 and supplies PHP code templates to partners and affiliates, who install them into compromised websites to redirect visitors toward scam content, including tech support scams hosted across more than 20,000 Cloudflare Pages domains. The reporting names three actors (Help TDS, Hotejka, ROI777), none of which has a MITRE ATT&CK profile in our reference data, so the attribution and the rebranding claim are unconfirmed. The risk to EMEA financial services is indirect but real: compromised legitimate web properties and abused Cloudflare Pages subdomains are being used as the front end of a monetized redirect chain, and any bank, insurer or asset manager whose marketing or customer-facing sites are compromised can be enrolled as a hop in that chain without the operator's knowledge.
2. Regulatory framing
The item is a threat-campaign report describing an abuse infrastructure and affiliate model. It does not describe an incident at a specific regulated entity, and the source does not name a victim, a jurisdiction, or a confirmed compromise of a financial services firm. On the facts available, no DORA or NIS2 article is directly engaged by this item. The table below records the two articles that would become engaged if a client confirms its own web estate or a third-party-hosted property has been enrolled in the Help TDS redirect chain; until that confirmation exists, they are contingent, not triggered.
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 18: classification of ICT-related incidents and cyber threats | A client confirms its own domain or a Cloudflare Pages property it controls is serving Help TDS redirect code to visitors | The compromise must be classified under the client's incident classification process, and the threat intelligence on Help TDS feeds the cyber threat component of that classification |
| NIS2 Art. 21(2)(d): supply chain security measures | A client's site is compromised via a third-party PHP template, plugin or hosting provider that forms part of its supply chain | Supply chain security measures must cover the template and hosting dependency, not only first-party code |
3. Technical analysis & attack chain
The source material is thin. It describes an affiliate model and a hosting pattern, not a step-by-step intrusion. The confirmed elements are set out below; everything beyond them is either absent from the source or single-sourced and is flagged as such.
Confirmed elements:
- Help TDS is a traffic distribution system, assessed active since at least 2017.
- It provides PHP code templates to partners and affiliates.
- Those templates are installed into compromised websites.
- The purpose of the installed code is to redirect unsuspecting visitors, in the source's phrasing, toward monetized destinations.
- Help TDS is linked to a Russian-language affiliate program called Hotejka.
- Hotejka appears to be a rebrand of a traffic monetization operation tracked as ROI777.
- More than 20,000 Cloudflare Pages domains are reported to host tech support scam content reached through this chain.
What the source does not provide, and what an analyst should therefore treat as unknown: the initial access vector used to compromise the websites that host the PHP templates; any CVE or vulnerable component; the specific PHP template filenames, function names, or injection points; the redirect logic (user-agent filtering, referer checks, geofencing, or IP reputation gating); the destination URL structure; any malware payload beyond the redirect itself; persistence mechanism; command-and-control; lateral movement; and any data access or exfiltration. None of these are stated, and none should be inferred from the general shape of a TDS.
The abuse of Cloudflare Pages is the operationally significant detail. Cloudflare Pages is a legitimate static hosting service, and subdomains under it inherit Cloudflare's domain reputation. That gives the affiliate program a large pool of high-reputation hosts for scam landing pages at low cost, and it means domain-reputation blocking alone will not separate the scam pages from legitimate Cloudflare-hosted content. The 20,000+ figure is a single-source claim from the reporting and has not been independently corroborated; treat it as an order of magnitude, not a count.
Attribution caveat: Help TDS, Hotejka and ROI777 have no MITRE ATT&CK profile in our reference data. The link between Help TDS and Hotejka, and the claim that Hotejka is a rebrand of ROI777, rest on the single source cited in §7. We are not treating the attribution as confirmed, and clients should not build blocking or escalation decisions on the actor names alone.
4. Mitigation & containment
The exposure here is web estate integrity and outbound redirect behaviour, not endpoint compromise. The steps below are ordered by what a client can act on today given the source's limited technical detail.
P1 (within 24 hours)
- Inventory every domain and subdomain your firm controls that is hosted on Cloudflare Pages or any comparable static hosting provider, and confirm which of them are production customer-facing properties. The 20,000+ figure in the source is a hosting pool, not a victim list, so the action is to know your own footprint.
- Search web server logs and CDN logs for requests to PHP files that are not part of your deployed application, particularly recently modified files in web roots. Help TDS delivers PHP templates, so unexpected PHP on a site that should be static is the highest-value signal.
- If you operate a marketing or customer-facing site on shared hosting or a CMS with third-party templates, diff the deployed template directory against your version-controlled source. Any file present on the server and absent from source control is a candidate.
P2 (within 72 hours)
- Add outbound redirect monitoring at the CDN or reverse proxy layer: alert on 3xx responses from your domains to destinations outside your own domain list. A TDS hop will show as a redirect your application did not intend to issue.
- Where your firm's brand is being impersonated on a Cloudflare Pages subdomain, submit an abuse report to Cloudflare with the specific subdomain and the scam content. Cloudflare Pages abuse handling is the correct channel; do not attempt to block the entire pages.dev space, which would break legitimate services.
- Review third-party PHP templates, plugins and themes in use across your web estate against their upstream source, and pin to a known-good version. The source does not name a specific vulnerable template, so this is a hygiene control, not a patch for a named CVE.
P3 (within 7 days)
- Add the redirect-chain behaviour to your brand protection monitoring: track lookalike and Cloudflare Pages subdomains that render tech support scam content using your brand, and feed confirmed cases into takedown.
- Brief customer-facing support teams on tech support scam call scripts that reference your brand, since the monetization endpoint of this chain is a scam interaction with the visitor.
No vendor fix, patch version, or CVE is named in the source. There is nothing to patch here; the controls are integrity checking and redirect monitoring.
5. Indicators of compromise
No atomic indicators of compromise are available in the source material. The source names no domains, IP addresses, URLs, file hashes, filenames, registry keys, or email addresses. The only infrastructure detail is the generic use of Cloudflare Pages hosting, which is a legitimate platform and not an indicator.
The source does describe observable behaviours. These are set out below as behavioural indicators; they are not machine-pivotable atomic indicators and are not placed in the copyable block.
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Unexpected PHP files present in the web root of a site that should be static or template-driven | Web server filesystem, deployment diff against source control | Single-sourced; the source states PHP templates are installed into compromised sites |
| Outbound 3xx redirects from a firm-controlled domain to an external destination not in the approved domain list | CDN logs, reverse proxy logs, web server access logs | Single-sourced; inferred from the described redirect function |
| Tech support scam landing pages hosted on Cloudflare Pages subdomains impersonating a financial brand | Brand protection monitoring, external attack surface scanning | Single-sourced; the 20,000+ domain figure is uncorroborated |
6. Detection
The source provides no file hashes, no distinctive strings, no command-line flags, no mutex names, no scheduled-task or service names, no filenames or paths, no registry keys, and no ransom-note text. The only named artefacts are the actor and program names (Help TDS, Hotejka, ROI777) and the platform name (Cloudflare Pages), none of which are artefacts of the threat itself. A rule built on those strings would detect reporting about the campaign, not the campaign.
Insufficient indicators to author detection rules.
7. Sources
- The Hacker News, "Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams", https://thehackernews.com/2026/10/help-tds-linked-to-hotejka-as-20000.html, published 2026-10-15.
This is the only source provided for this item. Every factual claim in this advisory traces to it, and no independent corroboration is available.
8. Adverse Trace position
We assess this as a low-to-moderate direct risk to EMEA financial services clients and a moderate risk to those with large, externally hosted web estates. There is no CVE, no KEV entry, and no confirmed victim in the financial sector in the source material, so we are not raising this to a P1 advisory. The material risk is that a client's own domain or a Cloudflare Pages property it controls is enrolled as a hop in the Help TDS redirect chain and begins serving scam content to its customers, which is a brand and customer-trust problem before it is a technical one. The attribution to Hotejka and the ROI777 rebrand claim are single-sourced and unconfirmed, and we will not treat the actor names as reliable until a second source corroborates them. Adverse Trace will monitor for additional reporting that names specific PHP template artefacts, redirect destinations, or victim domains, and will issue a follow-up if atomic indicators become available; in the meantime, clients should complete the P1 web estate inventory in §4 and report any confirmed redirect-chain enrolment back to us.
Published via PulseTrace — Adverse Trace threat intelligence.