- Infoblox attributes Help TDS, which sends victims to tech support scams from free Cloudflare Pages sites, to a Russian-language affiliate group called Hotejka.
- Blocklists of known-bad domains fit poorly when attackers use a popular platform. Infoblox says it flags new domains about seven days before use.
- Ask your security team how it treats new domains on shared platforms, and whether staff can install remote desktop tools without approval.
The scam no longer needs a bad neighbourhood
Scam networks once needed shady hosting. Help TDS now runs on free accounts at a popular, reliable provider. Infoblox's researchers found that its operators have used disposable Cloudflare Pages sites since April 2026.
The lesson here is that reputation can be rented. A domain on a trusted platform borrows some of that platform's good name. So the question "is this domain known to be bad?" misses the point. A better question is whether the domain behaves like a known attacker.
What Infoblox found
Help TDS is a traffic distribution system. Think of it as a relay that decides where each visitor goes. Infoblox says it has been active since at least April 2017. It sends people to tech support scams run from call centers.
Infoblox pins the operation on Hotejka, a small affiliate group that works in Russian. The group looks like the successor to ROI777, a scheme named publicly in 2018. The evidence includes old DNS records, loyalty to the same advertising platforms and steady control infrastructure. Infoblox says it is highly confident in the link.
The researchers found more than 20,000 Help TDS domains in six months. They also found about 10,000 more pages that look like phishing or decoys. In all, they counted about 30,000 domains. Only about 16,000 were announced on the group's Telegram channel.
How the machine works
Hotejka sells a route, not a website. Its affiliates include spam senders and people who break into websites. They send visitors through special links. The system checks each visitor's browser fingerprint and location. It then sends the visitor to the scam, or sells the traffic on to another advertising platform.
Since April 2026, the group's Telegram channel has refreshed its list of live domains every five minutes. Each domain resolves in DNS for about one week. DNS is the lookup system that turns a web address into a server. With lives that short, a blocklist is stale soon after it is published.
The group also varies its site names. Infoblox says the group used a dozen domain generation algorithms in six months, and half see heavy use. These are rules that create site names automatically. Infoblox worked out how they behave. It did not publish its method.
That work lets Infoblox flag new Hotejka domains about seven days before they go live. From July to mid-September, it flagged more than 16,000 domains that the group later used.
These figures cover only Infoblox customers. They come from the vendor's own research, and the company keeps its detection method private. Infoblox credits its early detection for the drop, but the figures are not independently verified. They do not measure exposure at other organisations.
What the victim sees
First, the visitor sees a notice that an update is required. Next, a screen claims Microsoft has disabled the machine. A "browser lock" makes the page hard to close. A recorded voice tells the person not to restart the computer, and a "Microsoft Security" phone number appears.
In mid-June 2026, Infoblox called that number and recorded the call. The fake Microsoft employee asked the researchers to install UltraViewer, a free remote desktop tool. It would give the caller full access to the machine.
Infoblox says the goal is remote access. That access can lead to information stealers and extortion, and the same victim can be targeted again.
The money is substantial. Infoblox suspects two European advertising programs have paid the group at least a few million dollars. That is the researchers' estimate, not an audited figure. In September 2026, the group also advertised a planned "forced browser extension installation" offer.
Questions for your security team
First, ask how your DNS filtering treats newly created domains on shared platforms such as pages.dev. Blocking the whole platform may not be practical, since many legitimate sites use it. Ask whether your provider scores domains by naming pattern and age, not only by past reports.
Second, ask whether staff can install remote desktop tools without approval. In the call Infoblox recorded, that single install was the goal.
Third, give employees a rule they can follow under pressure. A browser lock that cites Microsoft does not come from Microsoft. The approved response should be to close the browser and call the help desk.
Infoblox identified about 20 affiliates sending traffic to Help TDS in 2026. They include compromised websites and a Telegram bot. Your own site need not be involved. A single employee click elsewhere on the web can start the chain.
Infoblox's report does not describe any Cloudflare response. If you rely on a platform's reputation, ask how that provider handles abuse reports.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Infoblox.
