20,000+ Cloudflare Pages Domains Caught Hosting Tech Support Scams

Emily Davis · 2026-10-15

### The Hidden Network Behind Those Pop-Up Warnings You know those sudden browser pop-ups that scream your computer is infected? The ones that won't go away until you call a "support" number? Well, they're not random. A massive operation called Help TDS has been quietly powering those scams for years. Security researchers recently linked Help TDS to a Russian affiliate program called Hotejka. And Hotejka? It looks like a rebrand of an older traffic monetization scheme known as ROI777. So basically, the same players, new name, same dirty tricks. ### What Exactly Is Help TDS? TDS stands for Traffic Distribution System. Think of it as a traffic cop for the internet's underbelly. It decides which scam you see based on where you're browsing from, what device you're using, and a dozen other signals. Help TDS has been active since at least 2017. It hands out PHP code templates to affiliates. Those affiliates then sneak the code onto compromised websites. When you land on one of those sites, the code redirects you to a tech support scam page. > "It's like a franchise for fraud," one researcher told me. "Anyone can sign up, get the code, and start scamming. The TDS just takes a cut." ### The Cloudflare Pages Connection Here's where it gets really interesting. Over 20,000 domains hosted on Cloudflare Pages are being used to spread these scams. Cloudflare Pages is a legit service for developers to host static sites. But scammers are abusing it because it's free and fast. They create thousands of throwaway domains, each one looking like a real company or support page. Then they use Help TDS to funnel victims to them. Once you're there, you get a fake warning and a phone number to call. ### Why This Matters for You If you're a regular internet user, this is a reminder to never call a number from a pop-up. Ever. Real security software doesn't work that way. But if you're in digital privacy or antidetect browser work, this is a bigger deal. These scams often rely on browser fingerprinting to target specific users. They want to know if you're on a corporate network, what OS you use, even your approximate location. That's why antidetect browsers are becoming essential. They mask your fingerprint so you don't become a target. They also help you manage multiple profiles without leaving a trail. ### How to Protect Yourself - Never call a number from a pop-up or unsolicited warning. - Use an antidetect browser to spoof your fingerprint and avoid tracking. - Keep your browser and extensions updated. - If you manage websites, monitor for unauthorized PHP code. - Report suspicious Cloudflare Pages domains to Cloudflare's abuse team. ### The Bottom Line Help TDS and Hotejka are just the latest names for a problem that's been around for years. But the scale—20,000+ domains—is staggering. It shows how easy it is for scammers to abuse free hosting and traffic distribution systems. For privacy professionals, it's a wake-up call. The same tools that protect you can also be abused by criminals. Stay informed, stay skeptical, and always verify before you click.