Infoblox said its investigation, published on Thursday, linked the Help Traffic Distribution System, or Help TDS, to Hotejka, a Russian-language affiliate programme believed to be a successor to the previously exposed ROI777 network. The assessment rests on historical domain records, shared infrastructure, persistent affiliate identifiers and access to the programme’s administrative panel.
The researchers identified the malicious subdomains over six months after the operators shifted their scam pages to Cloudflare’s free website hosting service in April. They also discovered approximately 10,000 additional pages apparently associated with phishing or decoy activities, although their precise purposes remain uncertain.
Help TDS directs visitors from compromised websites, malicious advertisements, social media posts and spam towards deceptive warnings claiming that Microsoft Windows has encountered a serious security problem. Full-screen messages and browser controls are designed to discourage users from leaving and persuade them to telephone purported support staff.
The financial and security consequences can extend beyond an initial payment. During a controlled investigation in June, Infoblox researchers called a number displayed by one of the fraudulent pages. A person claiming to represent Microsoft technical support instructed them to install UltraViewer, a legitimate remote desktop application that could provide an outsider with access to their computer.
Such software has lawful support uses, but its installation at a scammer’s direction can expose files, credentials and other sensitive information. Infoblox warned that sustained remote access could enable further abuse, including information theft and extortion. Its investigation did not establish how many victims actually installed the programme or suffered financial losses.
The operation produces roughly 300 new Cloudflare Pages addresses daily, according to the researchers. Individual domains generally remain active in the domain name system for about a week, complicating attempts to block the infrastructure through conventional lists of known malicious websites.
Infoblox said it had reverse engineered patterns used to generate the addresses and developed detection techniques capable of identifying some domains approximately seven days before their deployment. By mid-September, it had detected more than 16,000 domains subsequently used by Help TDS.
The company reported that daily exposure among its cloud security customers had previously reached 4%, but fell below 0.5% during September following the deployment of its predictive detection methods. Those percentages measure exposure within its customer base, not the proportion of internet users affected worldwide.
Cloudflare Pages is a legitimate website publishing platform, and the findings concern criminal exploitation of its hosting facilities rather than a demonstrated compromise of Cloudflare itself. Infoblox said it typically observes more than 125,000 newly created Pages subdomains daily, making identification of the malicious fraction technically demanding.
Investigators assessed with high confidence that Hotejka and ROI777 share an operator. They cited overlapping internet infrastructure, historical registration records and advertising relationships maintained across successive versions of the traffic distribution system. The evidence supports a continuity assessment, rather than establishing the identities or whereabouts of individual operators.
Researchers identified about 20 affiliates supplying traffic to Help TDS during 2026, including Balada Injector, Detour Dog and DollyWay. Some affiliates exploit compromised WordPress websites, while others use different advertising and messaging channels to attract visitors before redirecting them through the network.
The programme also appears to monetise visitors who are not directed to technical support fraud by transferring traffic to other advertising networks. Infoblox estimated that relationships with two European affiliate platforms may have generated several million dollars over multiple years, but characterised that figure as an inference from observed traffic and estimated payments, not verified accounts.
Advertisements associated with Hotejka sought traffic from several countries, including the United States, Canada, France, Sweden, Japan and Australia. A September Telegram announcement also promoted plans for a system involving forced browser extension installation, although investigators said its proposed operation remained unclear.
The researchers also observed domains configured to redirect through DNS aliases rather than the main Help TDS pathway. One September example involved a parked domain passing visitors through advertising intermediaries before reaching a fraudulent support page.
Infoblox additionally documented a June incident involving a Telegram bot advertised as a free artificial intelligence assistant. After researchers interacted with the bot, it delivered advertisements leading to Help TDS, illustrating another route through which the affiliate network acquired prospective victims.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
