Researchers Link Hotejka to Help TDS and Detect Its Cloudflare Pages Domains in Advance
Summary
Infoblox researchers link Hotejka to the Help TDS tech-support scam operation and describe detecting its Cloudflare Pages domains about seven days before use, reducing exposure among their cloud customers.
Key points
- Researchers assess that Hotejka operates Help TDS and is a rebrand of ROI777, citing historical DNS, affiliate IDs, C2 infrastructure and direct access to an affiliate panel.
- Help TDS funnels users to fake Microsoft support call centers, where callers are urged to install UltraViewer, granting remote access to their devices.
- The operation receives traffic through compromised websites, malvertising, social media and spam; researchers say affiliates include Balada Injector, Detour Dog and DollyWay.
- Researchers reverse engineered multiple domain-generation algorithms and report detecting likely Help TDS Cloudflare Pages domains about seven days before use.
- Infoblox reports identifying more than 16,000 domains later used for the TDS; customer exposure in its cloud service fell from as high as 4% on one day to around 0.5%.
- Hotejka announced plans for a forced browser-extension installation system; the article says how it would work is unclear.
Article Details
- Attack Vectors
- Affiliate traffic from compromised domains, malvertising, social media posts, and spam is redirected to Help TDS through specially crafted URLs.
- Help TDS uses browser fingerprinting and location to route visitors to tech-support scams or other affiliate platforms.
- The scam uses browser-lock warnings and fake Microsoft support messaging to persuade victims to call a center and install UltraViewer for remote access.
- Hotejka affiliates can add lure code through a WordPress theme, plugin, or custom HTML block; the lures include fake CAPTCHAs and an update-required notice.
- Hotejka announced plans for forced browser extension installation, but the article says how this would work is unclear.
- Defensive Notes
- The researchers reverse-engineered Hotejka's domain-generation algorithms to predict Cloudflare Pages domains before their use; they report an average advance warning of about seven days.
- The researchers report that some customer exposure remained because of misconfigured response policy zones.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | arrow-berry-gem[.]pages[.]dev | Listed as a Help TDS domain hosted on Cloudflare Pages. |
| DOMAIN | ashen-drift-stone[.]pages[.]dev | Listed as a Help TDS domain hosted on Cloudflare Pages. |
| DOMAIN | fosetya[.]shop | Hotejka affiliate domain used to serve a tech-support-scam page and configured with a CNAME to hotcname[.]help. |
| DOMAIN | goalods[.]lol | Listed as a Hotejka affiliate domain. |
| DOMAIN | hotcname[.]help | Hotejka-controlled CNAME destination used to redirect affiliate traffic to its server. |
| DOMAIN | hotejka[.]ink | Listed as Hotejka's primary affiliate site. |
| DOMAIN | hotns[.]rest | Listed as a Hotejka nameserver. |
| DOMAIN | linen-thorn-wild[.]pages[.]dev | Help TDS domain on Cloudflare Pages detected and announced as C2 infrastructure; the article describes its reuse in separate periods. |
| DOMAIN | pinkfels[.]shop | Hotejka affiliate code uses a URL hosted here as a fallback source for retrieving the latest C2 domain. |
| DOMAIN | roi-traffic[.]icu | Identified as a historical C2 domain in a redirect chain associated with ROI777. |
| DOMAIN | roi777[.]com | Historical C2 infrastructure for the malicious ROI777 affiliate program and reported malicious redirects. |
| DOMAIN | roi777[.]online | Hosted login pages for the ROI777 operation. |
| DOMAIN | solar-cloud-branch[.]pages[.]dev | Listed as a Help TDS domain hosted on Cloudflare Pages. |
| DOMAIN | sun-sky-calm[.]pages[.]dev | Help TDS domain on Cloudflare Pages that displayed a decoy and was later announced as a C2 domain. |
| DOMAIN | trixsolvesxa[.]shop | Listed as a Hotejka affiliate domain. |
| DOMAIN | usa[.]on1xvpn[.]com | Listed as a Hotejka On1x VPN endpoint; the article says this hostname was directly connected to Hotejka and the tech-support scams. |
| DOMAIN | zylvantrexor[.]lol | Listed as a Hotejka affiliate domain. |
| IPV4 | 62[.]113[.]117[.]248 | Listed among Hotejka's infrastructure IP addresses. |
| IPV4 | 91[.]196[.]33[.]144 | Resolved for Hotejka's hotcname[.]help domain and associated with the tech-support-scam infrastructure. |
MITRE ATT&CK
T1219 · Remote Access ToolsThe call-center scammer instructed the researchers to download UltraViewer, which would give the attacker remote access to the victim's machine.T1568.002 · Domain Generation AlgorithmsHotejka uses several domain-generation algorithms to create Cloudflare Pages domains for Help TDS.T1614 · System Location DiscoveryHelp TDS evaluates visitors' location, along with browser fingerprinting, to decide where to route them.
People
Threat Actors
Balada InjectorIdentified as a long-term Hotejka affiliate that sent traffic to Help TDS.Detour DogIdentified as a long-term Hotejka affiliate that sent traffic to Help TDS.DollyWayIdentified as a long-term Hotejka affiliate that sent traffic to Help TDS.HotejkaAssessed by the researchers to operate Help TDS and its affiliate program; the article assesses Hotejka as a rebrand of ROI777.ROI777Historical operator of the precursor to Help TDS; the article assesses Hotejka as its rebrand.
Vendors
Products
Cloudflare PagesWhile they originally hosted their content on the notorious King Servers, the TDS and the tech support scams have been operated on free, disposable Cloudflare Pages (pages[.]dev) sites since April 2026.KeitaroHelp TDS itself was originally implemented on a Keitaro server, and we believe it remains so today.UltraViewerThe fake Microsoft employee eventually prompted us to download and install a free remote desktop tool, UltraViewer, which would give them complete access to our machine.WordPressWe also have direct access to their affiliate panel, which includes the malicious WordPress plugin documented by GoDaddy, as well as previously unknown lures.
Tools
Countries
AustraliaIn the most recent advertisements, they expanded their targeting to include the USA, Canada, France, Sweden, Japan, and Australia.Belgiumconversion rates and profits.” The poster then went on to specifically request traffic for France, Belgium, and Japan.CanadaIn the most recent advertisements, they expanded their targeting to include the USA, Canada, France, Sweden, Japan, and Australia.Francein higher conversion rates and profits.” The poster then went on to specifically request traffic for France, Belgium, and Japan.Japanrates and profits.” The poster then went on to specifically request traffic for France, Belgium, and Japan.SwedenIn the most recent advertisements, they expanded their targeting to include the USA, Canada, France, Sweden, Japan, and Australia.