Inside Help TDS: Hotejka, Cloudflare Pages and Predictive Detection

Hotejka, a Russian-language affiliate program believed to be a rebrand of ROI777, has operated the Help Traffic Distribution System (TDS) since April 2017. The TDS delivers tech support scams by redirecting users via browser fingerprinting and geolocation through compromised websites, malvertising, social media, and spam to fake Microsoft security alerts that lock browsers and display fraudulent phone numbers. When victims call, call center operators guide them to install remote desktop software such as UltraViewer, granting full system access for continued exploitation. Since April 2026, Hotejka has created over 20,000 disposable domains hosted on free Cloudflare Pages infrastructure, generating approximately 300 new domains daily. Affiliates including Balada Injector, Detour Dog, and DollyWay funnel traffic to the TDS. Infoblox developed predictive detection algorithms that identify these malicious domains roughly seven days before they are deployed, reducing customer exposure from 4% to 0.5%. The operation leverages a large network of disposable domains and sophisticated redirection techniques to sustain its scam campaigns.

Victims are redirected to fake security alerts that lock their browsers and display fraudulent phone numbers, leading to tech support scams. When victims call, attackers gain remote access to victims' systems via remote desktop tools like UltraViewer, enabling ongoing exploitation and potential data compromise. The large scale of disposable domains and rapid domain generation increases the difficulty of blocking the scam infrastructure. The operation affects users in multiple countries, including the United States, Australia, Belgium, Canada, France, Japan, and Sweden.

No official patch or fix applies as this is a scam infrastructure rather than a software vulnerability. Infoblox's predictive detection algorithms can identify malicious domains approximately seven days before deployment, significantly reducing exposure. Organizations should leverage threat intelligence feeds to block known malicious domains and IPs associated with Hotejka and its affiliates. User education to recognize tech support scams and avoid calling fraudulent numbers is critical. Blocking or monitoring for the listed malicious domains and IP addresses can help reduce victimization.