Infoblox ties Help TDS tech-support scams on 20,000+ abused Cloudflare Pages (pages.dev) subdomains to Hotejka
Infoblox links the Help TDS traffic system, which sends victims to fake Microsoft support pages on throwaway Cloudflare Pages subdomains, to the Hotejka affiliate program, a likely rebrand of ROI777.
- First reported
- Reports
- 1
Source: thehackernews.com · published
What happened
The Hacker News reported on October 15, 2026, based on an Infoblox report, that the long-running Help TDS traffic distribution system is linked to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of the traffic monetization operation ROI777. Help TDS is installed into compromised websites and redirects users to tech support scams that use full-screen browser manipulation to show bogus Microsoft Windows security alerts instructing victims to call a 'Windows Support' number; callers are told to install a remote desktop tool such as Ultraviewer. Since April 2026 the scam pages have been hosted on throwaway subdomains of Cloudflare's free Pages service (*.pages.dev), with roughly 300 disposable pages created per day and over 20,000 such domains detected; pages.dev itself is legitimate Cloudflare hosting that is being abused. The report notes that GoDaddy found roi777.com was one of the historical command-and-control domains used between 2018 and 2020 to fetch redirect domains, and that Hotejka's Telegram channel @hotejka_hot advertises forced browser extension installs and tech support landing pages that are 'very difficult to exit'. Microsoft is being impersonated and is not involved.
How the scam works
Help TDS is installed on compromised websites, mostly WordPress, through PHP templates, a malicious plugin GoDaddy identified as 'woocommerce_inputs', or a custom HTML block. About 20 affiliates, including Balada Injector, Detour Dog and DollyWay, send traffic to it. The system fingerprints each visitor's browser and location and decides where to send them; it runs on the Keitaro ad-tracking platform.
Some visitors see a fake Windows update, then a warning that the computer has been disabled by Microsoft and locked to block illegal activity, with instructions not to restart and to call 'Microsoft Technical Support'. Callers are told to install a remote desktop tool such as Ultraviewer, giving the scammers full control. Infoblox says this is not simple card fraud: once in, the attacker can exploit the victim again and again. Other visitors are resold to affiliate platforms and sent to fake CAPTCHA pages that sign the browser up for push-notification spam.
Hotejka has advertised on Telegram that a small call centre in Germany would handle 50–100 calls a day. Infoblox estimates the operators have earned at least a few million US dollars.
Source
The Hacker News, "Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams" (October 15, 2026), reporting Infoblox research.
Red flags
- A full-screen browser warning that your computer is locked or disabled by Microsoft.
- A phone number to call for 'Windows Support'.
- Instructions not to restart or close the browser.
- A request to install remote-access software such as Ultraviewer.
If you were targeted
- 1Don't call the number. Close the browser (use Task Manager or restart the computer if it won't close).
- 2Never install remote-access software for someone who contacted you or whose number came from a pop-up.
- 3If you already gave access, disconnect from the internet, uninstall the remote tool, run a security scan, change passwords from another device and call your bank if you paid.
- 4Report it to Microsoft at microsoft.com/reportascam and to your national fraud agency.