Infoblox Links Hotejka to Help TDS and Predicts Its Cloudflare Pages Domains
Summary
Infoblox researchers attribute Help TDS to Hotejka, linking it to ROI777, and describe its tech-support scam call centers. They reverse-engineered its domain-generation algorithms to detect Cloudflare Pages domains about seven days before use.
Key points
- Researchers assess with high confidence that Hotejka operates Help TDS and is a rebrand of the earlier ROI777 affiliate program, based on evidence including DNS history, affiliate identifiers, and access to an affiliate panel.
- Help TDS routes traffic from affiliates to tech-support scams using browser fingerprinting and location checks; researchers called a scam number and were directed to install UltraViewer for remote access.
- The operator has used Cloudflare Pages for Help TDS since April 2026, creating hundreds of pages daily through several domain-generation algorithms.
- By reverse-engineering those algorithms, Infoblox says it can identify actor-controlled pages about seven days before use; it detected more than 16,000 domains later used for the TDS through mid-September 2026.
- Infoblox reports that exposure among its cloud customers reached up to 4% on a single day after the move to Cloudflare Pages, then fell to around 0.5% with its new detections in place.
- The researchers observed traffic reaching Help TDS through compromised websites, malvertising, social media, and spam, and found decoy pages intended to disguise some domains.
Article Details
- Attack Vectors
- Affiliates direct users to Help TDS through compromised websites, malvertising, social media posts, and spam.
- Help TDS uses browser fingerprinting and location information to decide whether to route visitors to a tech support scam or another affiliate platform.
- Scam pages show fake update warnings, browser locks, alarms, and Microsoft branding to pressure users into calling a displayed support number.
- Call-center operators impersonate Microsoft support and instruct callers to install UltraViewer, which would give the operator remote access to the victim's machine.
- Affiliate code retrieves current TDS domains from a Telegram channel, with a fallback to a URL at pinkfels[.]shop, then builds affiliate-specific lure URLs.
- Some downstream affiliate pages use fake CAPTCHAs to induce visitors to accept browser push notifications.
- Defensive Notes
- Infoblox reports detecting new Help TDS Cloudflare Pages domains about seven days before use by reverse engineering the operator's domain-generation algorithms.
- Review response policy zone (RPZ) configuration; Infoblox attributes some remaining customer exposure to misconfigured RPZs.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | arrow-berry-gem[.]pages[.]dev | Listed as a Help TDS Cloudflare Pages domain. |
| DOMAIN | ashen-drift-stone[.]pages[.]dev | Listed as a Help TDS Cloudflare Pages domain. |
| DOMAIN | fosetya[.]shop | Hotejka affiliate domain that hosted a tech support scam page and pointed by CNAME to hotcname[.]help. |
| DOMAIN | goalods[.]lol | Listed as a Hotejka affiliate domain. |
| DOMAIN | hotcname[.]help | Hotejka-controlled domain used as the CNAME destination for affiliate traffic redirection. |
| DOMAIN | hotejka[.]com | Associated with the operator: it was used as a PTR record for an IP that also hosted roi777[.]com and tech-support-scam-related domains. |
| DOMAIN | hotejka[.]ink | Listed as Hotejka's primary affiliate site. |
| DOMAIN | hotns[.]rest | Listed as a Hotejka nameserver. |
| DOMAIN | linen-thorn-wild[.]pages[.]dev | Specific Cloudflare Pages domain detected and announced as a Help TDS C2 domain; the article describes its reuse. |
| DOMAIN | pinkfels[.]shop | Affiliate code uses a URL hosted on this domain as a fallback source for the current TDS domain. |
| DOMAIN | roi-traffic[.]icu | Identified as a historical C2 domain in a redirect chain associated with ROI777 traffic. |
| DOMAIN | roi777[.]com | Historical Help TDS command-and-control infrastructure associated with the ROI777 affiliate operation. |
| DOMAIN | roi777[.]online | Domain that hosted ROI777 login pages, according to the article's account of the operation. |
| DOMAIN | solar-cloud-branch[.]pages[.]dev | Listed as a Help TDS Cloudflare Pages domain. |
| DOMAIN | sun-sky-calm[.]pages[.]dev | Help TDS decoy-page domain later included in the operator's Telegram-announced C2 set. |
| DOMAIN | trixsolvesxa[.]shop | Listed as a Hotejka affiliate domain. |
| DOMAIN | zylvantrexor[.]lol | Listed as a Hotejka affiliate domain. |
| IPV4 | 162[.]244[.]35[.]33 | Operator-associated IP that hosted roi777[.]com and was used for the hotejka[.]com PTR record. |
| IPV4 | 62[.]113[.]117[.]248 | Listed among Hotejka-associated IP addresses and identified as VDS hosting. |
| IPV4 | 91[.]196[.]33[.]144 | IP resolving for hotcname[.]help and hosting the Hotejka-linked tech support scam infrastructure. |
MITRE ATT&CK
T1102.001 · Dead Drop ResolverAffiliate code checks a Telegram channel and extracts its latest listed domain to resolve the current Help TDS destination.T1219 · Remote Access ToolsA call-center operator instructed the researchers to download UltraViewer, which the article says would give the attacker remote access to the victim's system.T1568.002 · Domain Generation AlgorithmsThe operator uses several domain-generation algorithms to create large numbers of Cloudflare Pages domains for Help TDS.T1583.001 · DomainsThe operator creates hundreds of Cloudflare Pages subdomains daily and uses them as Help TDS infrastructure.T1656 · ImpersonationCall-center operators posed as Microsoft Technical Support, while scam pages displayed Microsoft branding and a purported Microsoft Security phone number.
People
Threat Actors
Balada InjectorIdentified as a long-standing Hotejka affiliate and website-malware actor that returned to activity in May 2026 after being dormant since December 2024.Detour DogIdentified as a long-standing Hotejka affiliate and website-malware actor that sends traffic to Help TDS.DollyWayIdentified as a long-standing Hotejka affiliate and website-malware actor that sends traffic to Help TDS.HotejkaInfoblox assesses with high confidence that Hotejka operates Help TDS and its affiliate program, routing traffic to tech support scams. The article says Hotejka appears to be a rebrand of ROI777.ROI777Reported as the operator of the Disposable TDS precursor to Help TDS. The article presents evidence linking ROI777 to Hotejka and assesses that Hotejka appears to be its rebrand.
Vendors
Products
Cloudflare PagesWhile they originally hosted their content on the notorious King Servers, the TDS and the tech support scams have been operated on free, disposable Cloudflare Pages (pages[.]dev) sites since April 2026.Keitaro TrackerHelp TDS itself was originally implemented on a Keitaro server, and we believe it remains so today.TelegramWe found advertisements by Hotejka on Telegram and internet sites that showed criminal intent.UltraViewerThe fake Microsoft employee eventually prompted us to download and install a free remote desktop tool, UltraViewer, which would give them complete access to our machine.WordPressWe also have direct access to their affiliate panel, which includes the malicious WordPress plugin documented by GoDaddy, as well as previously unknown lures.
Countries
AustraliaIn the most recent advertisements, they expanded their targeting to include the USA, Canada, France, Sweden, Japan, and Australia.Belgiumconversion rates and profits.” The poster then went on to specifically request traffic for France, Belgium, and Japan.CanadaIn the most recent advertisements, they expanded their targeting to include the USA, Canada, France, Sweden, Japan, and Australia.Francein higher conversion rates and profits.” The poster then went on to specifically request traffic for France, Belgium, and Japan.Japanrates and profits.” The poster then went on to specifically request traffic for France, Belgium, and Japan.SwedenIn the most recent advertisements, they expanded their targeting to include the USA, Canada, France, Sweden, Japan, and Australia.United StatesHotejka’s operations in 2026 leverage U.S.