Help TDS tied to Hotejka (ROI777 rebrand): Infoblox finds 20,000+ disposable Cloudflare Pages domains since April 2026 pushing tech-support scareware to call centres that install UltraViewer
Infoblox Threat Intelligence published research on 15 October 2026 linking the long-running Help Traffic Distribution System (Help TDS), active since at least April 2017, to the Russian-language affiliate program Hotejka, which Infoblox assesses is a rebrand of the older ROI777 traffic operation. Help TDS sells PHP templates that affiliates plant on compromised websites to steer visitors into tech-support scams: full-screen fake Microsoft/Windows security alerts and exit-prevention tricks urge the victim to phone a 'support' number; operators then push free remote-desktop tools such as UltraViewer so they can take over the machine. Since April 2026 the scam landers have been hosted on free Cloudflare Pages (*.pages.dev). Infoblox says Hotejka's Telegram channel announces nearly 300 new Pages destinations a day and that researchers detected more than 20,000 such domains in six months, plus about 10,000 more pages that look like phishing or decoys. Each destination typically resolves for about a week. Infoblox also ties Help TDS traffic to prolific website malware actors including Detour Dog, Balada Injector and DollyWay. Primary: Infoblox; wire: The Hacker News (15 Oct).
- Product
- Compromised websites and Cloudflare Pages (*.pages.dev) used as Help TDS tech-support scam landers
- Versions
- n/a — campaign / traffic-distribution system (Help TDS since ~2017; Cloudflare Pages landers since April 2026)
- Exploited in Australia?
- unknown
- Patch to
- Users: never call numbers from browser 'Windows security' full-screen warnings, and do not install UltraViewer or other remote-access tools because a pop-up told you to. Close the tab from Task Manager / force-quit if the page traps you. Site owners: hunt for Help TDS PHP droppers and unexpected plugins that redirect search visitors; monitor for mass *.pages.dev redirects. Network defenders: treat newly registered pages.dev hostnames that match Help TDS patterns as suspicious and block known Hotejka/Help TDS indicators from Infoblox where available.
Primary: Infoblox — Inside Help TDS: Hotejka and Cloudflare Pages abuse (15 Oct 2026) · Vendor: Infoblox Threat Intelligence (primary research) · The Hacker News — Help TDS linked to Hotejka as 20,000+ Cloudflare Pages domains host tech support scams (15 Oct 2026)