Threat reportPhishingTL-2026-3844
Hotejka Help TDS Abuses 20,000+ Cloudflare Pages Domains to Push Fake Microsoft Security Alerts (Tech Support Scam)
Hotejka Help TDS Abuses 20,000+ Cloudflare Pages Domains to (TL-2026-3844), also tracked as Help TDS, is a medium-severity phishing campaign, first published 2026-10-17. It is attributed to Hotejka with medium confidence, affects Cloudflare Cloudflare Pages (pages.dev) - abused as free hosting, maps to 10 MITRE ATT&CK techniques (T1036, T1204.001, T1204.002), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 1Hotejka
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-3844
- Threat ID
- TL-2026-3844
- Also known as
- Help TDS, Hotejka affiliate program, ROI777
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution
- Hotejka
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- consumers, general-public, small-business
- Target regions
- united states of america, canada, france, sweden, belgium, japan, australia
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Hotejka Help TDS Abuses 20,000+ Cloudflare Pages Domains to
Malware and tooling: DollyWay, UltraViewer
How Hotejka Help TDS Abuses 20,000+ Cloudflare Pages Domains to works
Help TDS, a traffic distribution system run by the Russian-language Hotejka affiliate program (assessed as a rebrand of ROI777), used over 20,000 Cloudflare Pages domains in six months to show fake Microsoft security alerts and steer victims to scam call centers. Operators pose as Microsoft Technical Support and have victims install UltraViewer for remote access.
Help TDS is a long-running traffic distribution system (TDS) that has funneled victims to tech support scams since at least April 2017. Infoblox (published 2026-10-15) assesses it is operated by Hotejka, a Russian-language affiliate program that appears to be a rebrand of ROI777. Attribution rests on shared hosting (162.244.35.33), a consistent PTR record for hotejka.com, an affiliate identifier (u=h2xkd0) seen across roughly eight years, Telegram handle continuity, loyalty to the same two European affiliate advertising platforms, and identical call-center tradecraft. The sources describe the operator only as Russian-speaking with Moscow-timezone references. No state sponsorship is stated.
Traffic reaches Help TDS from compromised websites (malicious PHP templates and WordPress plugins, including the 'woocommerce_inputs' plugin documented by GoDaddy in August 2025), malvertising, social media and spam. Roughly 20 affiliates feed it, among them Balada Injector, Detour Dog and DollyWay. Help TDS fingerprints the browser and geolocation and qualifies the visitor. It time-gates the scam to U.S. business hours (9am-6pm EDT). Qualified visitors get a Microsoft-branded 'update required' or security warning, then a full-screen browser lock with exit prevention, alarming visuals and audio that make the machine look disabled. Victims who call the listed number reach operators claiming to be Microsoft Technical Support. After basic troubleshooting, those operators ask the victim to install UltraViewer, a legitimate remote desktop tool, which gives them full access to the machine. Infoblox notes that this access enables follow-on information stealers, extortion and persistent remote access. Help TDS has also historically handed traffic to downstream affiliate platforms such as VexTrio Viper.
In April 2026 the operation moved from earlier Keitaro-based infrastructure (King Servers hosting 2017-2022) to free Cloudflare Pages (pages.dev) subdomains. Hotejka creates about 300 new disposable domains a day using multiple DGAs and announces them through Telegram channels (trafficredirect, hotejka_hot). Infoblox reports roughly 20,000 Help TDS domains over six months, plus about 10,000 decoy or phishing Pages domains, and domain reuse across time periods (apparent domain warming). C2 rotation is about every five minutes, with backup domain lists hosted on pinkfels.shop and DNS CNAME redirection through hotcname.help. Hotejka claims affiliate payouts of $20-30k USD per day and about $100 per U.S. victim contact. Infoblox estimates lifetime payouts of at least a few million USD. Targeted geographies include the USA, Canada, France, Sweden, Belgium, Japan and Australia. Infoblox says its predictive detection flags the domains about 7 days before use, which cut daily exposure among its cloud customers from about 4% to below 0.5% by September 2026.
Severity MEDIUM is an analyst assignment, not a source statement. There is no CVE or CVSS score.
MITRE ATT&CK techniques used in TL-2026-3844
Defense Evasion
T1036 Masquerading; T1480 Execution Guardrails
Execution
T1204.001 User Execution: Malicious Link; T1204.002 User Execution: Malicious File
Command and Control
T1219 Remote Access Tools; T1568.002 Dynamic Resolution: Domain Generation Algorithms
Initial Access
T1566.004 Phishing: Spearphishing Voice; T1659 Content Injection
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1583.006 Acquire Infrastructure: Web Services
Affected products and versions in Hotejka Help TDS Abuses 20,000+ Cloudflare Pages Domains to
- Cloudflare — Cloudflare Pages (pages.dev) - abused as free hosting
- WordPress ecosystem — Compromised WordPress sites (malicious plugins such as woocommerce_inputs, injected PHP templates)
- Microsoft — Microsoft Windows users / Microsoft brand impersonated in fake alerts
Remediation for Hotejka Help TDS Abuses 20,000+ Cloudflare Pages Domains to
Immediate actions
- Block or sinkhole the Hotejka operator domains (hotejka.ink, hotns.rest, hotcname.help, pinkfels.shop) and the listed Help TDS pages.dev hostnames at DNS or proxy
- Alert on DNS CNAME responses pointing to hotcname.help and on resolution of usa.on1xvpn.com / usa.on1xvpn.ru
- Alert on corporate-network outbound calls or lookups tied to the scam phone numbers +1 855-616-3518, +1 855-361-0064 and +1 844-959-1966
- Hunt endpoints for unsanctioned UltraViewer installs or sessions, and investigate any host whose user reports a fake Microsoft warning or browser lock
Workarounds
- Close the locked browser via Task Manager or restart in safe mode; do not call the displayed number or install remote access software
Longer-term hardening
- Apply RPZ or protective DNS with predictive or newly-observed-domain detection for pages.dev subdomains
- Restrict remote access tools to an approved allowlist and block UltraViewer where it is not needed
- Train users that Microsoft does not make unsolicited calls, that a browser lock cannot disable the device, and that the lock can be escaped via Task Manager or safe mode
- Audit WordPress sites for unauthorized plugins, theme-editor changes and custom HTML block injections, and review installs against GoDaddy's woocommerce_inputs advisory
Timeline of Hotejka Help TDS Abuses 20,000+ Cloudflare Pages Domains to
- Help TDS operational, delivering tech support scams (source gives April 2017 only; day set to the 1st).
- ROI777 exposed and server data published to Pastebin; operation rebranded as 'Disposable TDS' (month precision per Infoblox).
- hotejka.com registered and Telegram channels established in late 2019; Hotejka branding later solidified after the ROI777 portal vanished in January 2022 (month precision).
- GoDaddy documents the malicious WordPress plugin 'woocommerce_inputs' used by Help TDS to steal WordPress credentials and fetch redirect URLs from C2 (month precision).
- Help TDS migrates to Cloudflare Pages (pages.dev), creating about 300 disposable domains per day announced via Telegram (month precision).
- Infoblox researchers test a scam call center; UltraViewer deployment is standardized as the remote access step (month precision).
- Infoblox predictive detection has cut daily exposure among its cloud customers from 4% peaks to below 0.5%; Hotejka announces forced browser extension monetization (month precision).
- Infoblox publishes research attributing Help TDS to Hotejka and linking it to ROI777.
- Cyber Security News reports the campaign: 20,000+ Cloudflare Pages domains used over six months.
Sources cited for Hotejka Help TDS Abuses 20,000+ Cloudflare Pages Domains to
- Inside Help TDS: Hotejka, Cloudflare Pages and Predictive Detection (Infoblox)
- Hackers Abuse 20,000 Cloudflare Pages Domains to Push Fake Microsoft Security Alerts (Cyber Security News)
- Help TDS Linked to Hotejka as 20,000 Cloudflare Pages Domains Abused (The Hacker News)
- Help TDS: Fake Microsoft Support Pushes Remote Access (GridinSoft)
- Help TDS malicious plugins redirect to tech support scams (GoDaddy)
- Operation Prowli: Traffic Manipulation and Cryptocurrency Mining (Akamai/Guardicore)
- Cloudflare Pages and Workers Domains Increasingly Abused for Phishing (Fortra)
Detection coverage for TL-2026-3844
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3844 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.