Inside Help TDS: Hotejka, Cloudflare Pages and Predictive Detection
Since April 2017, a Russian-language affiliate program called Hotejka, believed to be a rebrand of ROI777, has operated the Help Traffic Distribution System (TDS), delivering tech support scams to victims. The operation uses browser fingerprinting and geolocation to redirect users through compromised websites, malvertising, social media, and spam to fake Microsoft security alerts that lock browsers and display fraudulent phone numbers. When victims call, operators from call centers guide them to install remote desktop tools like UltraViewer, granting complete system access for ongoing exploitation. Since April 2026, Hotejka has created over 20,000 disposable domains on free Cloudflare Pages infrastructure, generating approximately 300 new domains daily. Affiliates including Balada Injector, Detour Dog, and DollyWay drive traffic to the TDS. Infoblox developed predictive detection algorithms that identify malicious domains approximately seven days before deployment, reducing customer exposure from 4% to 0.5...
Pulse ID: 6ad1d2421e774bf7224baf2b
Pulse Link: https://otx.alienvault.com/pulse/6ad1d2421e774bf7224baf2b
Pulse Author: AlienVault
Created: 2026-10-16 07:29:06
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#Malvertising #Microsoft #SocialMedia #Spam #OTX #AlienVault