A Traffic Distribution System (TDS) known as Help TDS has been linked to Hotejka, a Russian-language affiliate program suspected to be a rebrand of the traffic monetization scheme ROI777. Operating since at least 2017, Help TDS facilitates tech support scams by deploying PHP code templates on compromised websites, redirecting victims to fraudulent Microsoft Windows security alerts.
Tech Support Scam Mechanism
Help TDS manipulates browsers to display fake security alerts, urging users to contact a supposed Windows Support number. According to Infoblox, these scams lead victims to call centers where social engineering tactics convince them to install remote desktop tools, enabling the threat actors to exploit their systems repeatedly.
Evolution and Techniques
In August 2025, GoDaddy documented the evolution of Help TDS, noting its use of a malicious WordPress plugin, “woocommerce_inputs,” which helps steal credentials and facilitate malicious redirections. Historical tracking shows connections to VexTrio Viper, a cybercrime operator known for scams and malware distribution.
The TDS functions as a traffic relay, intercepting and analyzing internet traffic from compromised sources. Using criteria like geographic location and device metadata, it routes victims to scams and malware. Implemented on the Keitaro platform, Help TDS employs scare tactics, prompting users to contact fraudulent support services.
Hotejka’s Connection to ROI777
Hotejka is believed to be a successor to ROI777, tied to Operation Prowli, a campaign involving cryptocurrency mining and traffic manipulation. ROI777 purchased traffic from compromised sources and redirected it to domains hosting scams and malicious extensions.
Data leaks from ROI777’s servers in 2018 revealed user identities and campaign details, leading to the rebranding to Hotejka. GoDaddy’s investigation found that “roi777[.]com” was used as a command-and-control domain, further linking the two entities.
Since April 2026, Hotejka has operated tech support scams via free Cloudflare Pages, creating around 300 disposable domains daily. With over 20,000 domains detected, the operation has heavily targeted WordPress sites, redirecting victims to fraudulent pages.
Conclusion
The longstanding relationship between Hotejka and its precursor, ROI777, demonstrates a persistent and lucrative affiliation with platforms facilitating tech support scams. Analyzing DNS records and affiliate IDs reveals significant earnings from these operations, estimated in the millions of dollars. The ongoing threat underscores the need for enhanced vigilance and cybersecurity measures.
