# Hotejka Help TDS Abuses 20,000+ Cloudflare Pages Domains to Push Fake Microsoft Security Alerts (Tech Support Scam)

> Help TDS, a traffic distribution system run by the Russian-language Hotejka affiliate program (assessed as a rebrand of ROI777), used over 20,000 Cloudflare Pages domains in six months to show fake Microsoft security alerts and steer victims to scam call centers. Operators pose as Microsoft Technical Support and have victims install UltraViewer for remote access.

- **Published:** 2026-10-17T22:01:05Z
- **Last reviewed:** 2026-10-17T22:01:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3844
- **ID:** TL-2026-3844
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** Hotejka
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Help TDS is a long-running traffic distribution system (TDS) that has funneled victims to tech support scams since at least April 2017. Infoblox (published 2026-10-15) assesses it is operated by Hotejka, a Russian-language affiliate program that appears to be a rebrand of ROI777. Attribution rests on shared hosting (162.244.35.33), a consistent PTR record for hotejka.com, an affiliate identifier (u=h2xkd0) seen across roughly eight years, Telegram handle continuity, loyalty to the same two European affiliate advertising platforms, and identical call-center tradecraft. The sources describe the operator only as Russian-speaking with Moscow-timezone references. No state sponsorship is stated.

Traffic reaches Help TDS from compromised websites (malicious PHP templates and WordPress plugins, including the 'woocommerce_inputs' plugin documented by GoDaddy in August 2025), malvertising, social media and spam. Roughly 20 affiliates feed it, among them Balada Injector, Detour Dog and DollyWay. Help TDS fingerprints the browser and geolocation and qualifies the visitor. It time-gates the scam to U.S. business hours (9am-6pm EDT). Qualified visitors get a Microsoft-branded 'update required' or security warning, then a full-screen browser lock with exit prevention, alarming visuals and audio that make the machine look disabled. Victims who call the listed number reach operators claiming to be Microsoft Technical Support. After basic troubleshooting, those operators ask the victim to install UltraViewer, a legitimate remote desktop tool, which gives them full access to the machine. Infoblox notes that this access enables follow-on information stealers, extortion and persistent remote access. Help TDS has also historically handed traffic to downstream affiliate platforms such as VexTrio Viper.

In April 2026 the operation moved from earlier Keitaro-based infrastructure (King Servers hosting 2017-2022) to free Cloudflare Pages (pages.dev) subdomains. Hotejka creates about 300 new disposable domains a day using multiple DGAs and announces them through Telegram channels (trafficredirect, hotejka_hot). Infoblox reports roughly 20,000 Help TDS domains over six months, plus about 10,000 decoy or phishing Pages domains, and domain reuse across time periods (apparent domain warming). C2 rotation is about every five minutes, with backup domain lists hosted on pinkfels.shop and DNS CNAME redirection through hotcname.help. Hotejka claims affiliate payouts of $20-30k USD per day and about $100 per U.S. victim contact. Infoblox estimates lifetime payouts of at least a few million USD. Targeted geographies include the USA, Canada, France, Sweden, Belgium, Japan and Australia. Infoblox says its predictive detection flags the domains about 7 days before use, which cut daily exposure among its cloud customers from about 4% to below 0.5% by September 2026.

Severity MEDIUM is an analyst assignment, not a source statement. There is no CVE or CVSS score.

## MITRE ATT&CK

- T1566.004 Phishing: Spearphishing Voice
- T1659 Content Injection
- T1583.001 Acquire Infrastructure: Domains
- T1583.006 Acquire Infrastructure: Web Services
- T1204.001 User Execution: Malicious Link
- T1204.002 User Execution: Malicious File
- T1036 Masquerading
- T1480 Execution Guardrails
- T1568.002 Dynamic Resolution: Domain Generation Algorithms
- T1219 Remote Access Tools

## Sources

- [Inside Help TDS: Hotejka, Cloudflare Pages and Predictive Detection (Infoblox)](https://www.infoblox.com/blog/threat-intelligence/inside-help-tds-hotejka-cloudflare-pages-and-predictive-detection/)
- [Hackers Abuse 20,000 Cloudflare Pages Domains to Push Fake Microsoft Security Alerts (Cyber Security News)](https://cybersecuritynews.com/cloudflare-pages-domains/)
- [Help TDS Linked to Hotejka as 20,000 Cloudflare Pages Domains Abused (The Hacker News)](https://thehackernews.com/2026/10/help-tds-linked-to-hotejka-as-20000.html)
- [Help TDS: Fake Microsoft Support Pushes Remote Access (GridinSoft)](https://blog.gridinsoft.com/help-tds-hotejka-fake-support-remote-access/)
- [Help TDS malicious plugins redirect to tech support scams (GoDaddy)](https://www.godaddy.com/resources/news/help-tds-malicious-plugins-redirect-tech-support-scams)
- [Operation Prowli: Traffic Manipulation and Cryptocurrency Mining (Akamai/Guardicore)](https://www.akamai.com/blog/security/operation-prowli-traffic-manipulation-cryptocurrency-mining)
- [Cloudflare Pages and Workers Domains Increasingly Abused for Phishing (Fortra)](https://www.fortra.com/blog/cloudflare-pages-workers-domains-increasingly-abused-for-phishing)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3844