Researchers link the long-running operation to Russian-language affiliate program Hotejka, identifying more than 20,000 related domains in six months and detecting campaign infrastructure before it is activated.
Infoblox Threat Intel has traced a long-running tech-support scam operation known as Help TDS to Hotejka, a Russian-language affiliate program that researchers believe is a rebrand of ROI777. Active since at least April 2017, the operation directs victims to call centres where scammers persuade them to install remote-access software, potentially giving attackers control of their devices.
Help TDS uses a traffic distribution system (TDS) to route visitors from compromised websites, malicious advertisements, social media and spam to fraudulent support operations. The model goes beyond conventional payment fraud, relying on social engineering to gain access to victims’ computers.
“Today’s tech-support scams are complex social engineering attacks that can give threat actors unfettered access to devices and enable continued exploitation long after the initial call.” — Renée Burton, VP, Infoblox Threat Intel
In June 2026, Infoblox researchers followed the operation’s infrastructure to a call centre. A purported support employee helped remove a browser lock before instructing the researchers to download UltraViewer, a free remote-desktop tool that could have enabled the scammers to access the computer.
Since April 2026, Hotejka has used Cloudflare Pages to generate hundreds of pages daily. Infoblox detected more than 20,000 related domains over six months, alongside 10,000 pages apparently designed for phishing or use as decoys.
The research team says it can now identify campaign domains approximately seven days before they are used, creating an opportunity to disrupt attacks before victims encounter them.
The early-detection approach has also reduced exposure among Infoblox cloud customers. According to the company, exposure that reached as high as 4% on a single day fell to below 0.5% in September.
The findings highlight how free web-hosting services and remote-access tools can be incorporated into persistent scam infrastructure. Infoblox says its DNS threat intelligence helps identify and disrupt malicious activity earlier, rather than relying solely on defensive measures after an attack has begun.
Read the full research: https://www.infoblox.com/blog/threat-intelligence/inside-help-tds-hotejka-cloudflare-pages-and-predictive-detection/
