THE Hacker News reports that a long-running Traffic Distribution System (TDS) known as Help TDS is again being tied to the Hotejka ecosystem, believed to be a rebrand of ROI777. The operation has been active since at least 2017 and works by injecting PHP templates or HTML blocks into compromised websites to steer visitors toward tech support scams.
Infoblox describes Help TDS as a routing infrastructure that fingerprint-reviews visitors and redirects them to scams, browser lock screens and remote-access setups, often prompting users to call a Microsoft Technical Support number and install a remote desktop tool. The campaign has historically moved traffic to affiliates and other crime groups, and is built around a central Keitaro advertising/tracking platform.
Evidence cited by GoDaddy and Infoblox links Help TDS to Hotejka and ROI777 through shared C2 domains, DNS patterns, and long-standing redirect chains. Since April 2026, the activity has shifted to free Cloudflare Pages sites, with the operator creating roughly 300 disposable pages per day and identifying more than 20,000 domains to host redirects.
The article notes around 20 different affiliates—such as Balada Injector, Detour Dog and DollyWay—feeding traffic to Help TDS, with WordPress and other CMS sites frequently targeted to funnel visitors to scams, push-notification spam, or malware drops. Telegram posts from Hotejka illustrate aggressive, hard-to-exit scam pages and large-scale operations, including a stated German call-centre capacity.
The piece frames ROI777 and Hotejka as highly interlinked, based on historical C2 activity and DNS patterns, underscoring the scale and persistence of these monetisation-for-scams networks.