Security researchers have reported that a long-running traffic distribution system, known as Help TDS, has been linked to a Russian-language affiliate program called Hotejka. According to the report, the infrastructure has involved more than 20,000 domains hosted on Cloudflare Pages and has been used to support tech support scam activity.

The findings are important for European businesses because they point to a familiar but costly pattern: compromised websites, abused cloud services, and malicious redirection chains that can expose customers, employees and site visitors to fraud. While the reported activity centres on scam delivery, the underlying techniques are also relevant to broader website security, brand trust and digital operations.

What happened

According to the researchers, Help TDS has been active since at least 2017. A traffic distribution system, or TDS, is typically used to route visitors to different destinations based on factors such as location, device type or referral source. In legitimate marketing, similar routing can be used for campaign management. In criminal operations, the same concept can be used to selectively direct victims to scam pages or other malicious content.

The report says Help TDS provided PHP code templates to affiliates and partners, which were then installed on compromised websites. Those infected sites could be used to redirect visitors without their knowledge. Researchers also linked the activity to Hotejka, which they assess may be a rebrand of an earlier traffic monetisation operation known as ROI777. These are the researchers' assessments, not independently verified legal findings.

The reported use of Cloudflare Pages matters because it shows how attackers can exploit reputable cloud and web delivery platforms to scale scam infrastructure and make malicious content appear more trustworthy. The presence of scam content on well-known hosting or delivery services does not mean the platform itself is malicious, but it does create additional challenges for defenders, users and businesses that rely on web reputation signals.

Why it matters for European businesses

For SMEs, e-commerce businesses and marketing teams, this is not just a consumer scam story. If a corporate website, landing page or microsite is compromised and used in a redirection chain, the business may face reputational damage, loss of customer trust, SEO issues, ad platform policy problems and incident response costs.

The case also underlines a broader security issue: many organisations still treat websites as static marketing assets rather than internet-facing systems that require ongoing security controls. A compromised CMS, vulnerable plugin, weak credentials or poorly monitored custom script can turn a legitimate site into part of a criminal traffic network.

There is also a cloud governance angle. Many businesses use modern website deployment tools and serverless hosting platforms because they are fast and cost-efficient. But threat actors also use the same platforms. Security teams should therefore avoid assuming that content hosted on a recognised platform is automatically safe.

For regulated businesses, any website compromise that leads to customer exposure, credential theft, fraudulent redirects or broader system intrusion may trigger additional legal, contractual or reporting considerations depending on the facts of the incident. Whether notification duties apply would depend on the specific impact and the applicable rules.

Who may be affected

• SMEs with content-managed websites
  Businesses running WordPress, custom PHP sites or older web stacks may be exposed if security patching and plugin management are weak.
• E-commerce companies
  Online stores risk customer distrust, conversion loss and possible fraud exposure if visitors are redirected to scam pages.
• Marketing teams and agencies
  Campaign landing pages, microsites and third-party tracking scripts can become blind spots if governance is weak.
• IT and web operations teams
  Teams responsible for hosting, code deployment, DNS and monitoring may need to review detection rules for unexpected redirects and injected code.
• Brands using cloud web platforms
  Companies should be aware that trusted hosting brands can be abused by attackers, making manual review and automated monitoring more important.

What companies should consider

• Audit websites for unauthorised redirects and injected scripts
  Check public-facing sites, landing pages and older domains for unexpected PHP files, redirection logic, suspicious JavaScript and recently changed templates.
• Review CMS, plugin and theme security
  Apply updates promptly, remove unused components and limit administrator access. Older or abandoned plugins remain a common entry point.
• Monitor for changes across web assets
  Use file integrity monitoring, deployment logs and alerting for unusual modifications to pages, scripts and DNS settings.
• Harden access controls
  Enable multi-factor authentication for CMS, hosting, registrar and cloud platform accounts. Limit privileged access to only those who need it.
• Inspect third-party code and partner integrations
  Tracking tags, ad scripts and externally managed page elements should be reviewed regularly, especially on high-traffic campaign pages.
• Prepare an incident response path for website abuse
  Have a process for isolating compromised pages, communicating with hosting providers, preserving evidence and checking whether customer data or internal credentials may have been exposed.
• Do not rely only on platform reputation
  Train teams to verify destinations and behaviours, not just domain appearance or hosting provider name, when reviewing suspicious activity.

Although the reported campaign focuses on tech support scams, the business lesson is wider: compromised websites can be turned into traffic brokers for criminal operations. For European companies, especially smaller firms with limited in-house security resources, basic website security hygiene and continuous monitoring remain essential controls.