Summary
- Infoblox attributes Help TDS to the Russian-language affiliate operation Hotejka.
- The researchers detected more than 20,000 associated disposable pages during six months.
- The reported activity directs users towards tech support scams and remote access rather than simple payment-form theft.
A long-running online traffic distribution system used to steer people into technical support scams is operated by a Russian-language affiliate programme believed to be based in Eastern Europe, according to a new investigation by Infoblox.
The company links Help TDS to Hotejka, which researchers assess to be a continuation of an operation previously exposed as ROI777. They traced activity extending back to at least 2017 and identified a change in hosting infrastructure during 2026, with the operators increasingly using disposable pages created on Cloudflare Pages.
Infoblox says it observed more than 20,000 such domains over six months, alongside approximately 10,000 additional pages that appeared to support related phishing or decoy activities. Those counts represent infrastructure found by researchers, not a verified number of victims, successful remote connections, or compromised businesses.
A traffic distribution system sits between an initial lure and the destination shown to the visitor. Different traffic can be routed according to device attributes, geographic location, or other criteria. That allows an operator to change scam destinations without replacing every upstream advertisement or compromised referring page.
In the Help TDS operation, the downstream activity centres on fake technical support. The researchers describe browser-locking messages and call-centre interactions designed to persuade a victim to install remote desktop tools. Once a remote connection is established, the risk changes from a fraudulent payment request to possible access to files, accounts, and other information available to the user.
Infoblox’s assessment is based on advertising by Hotejka, infrastructure patterns, and continuity with previously documented activity. The company places the operators in Eastern Europe on an assessed basis rather than presenting a publicly verified address or legal identity. Its identification of an affiliate programme also does not establish that every participating scammer is part of one centrally controlled organisation.
The use of Cloudflare Pages illustrates the dual-use problem of legitimate hosting services. A free or low-cost page can be created and replaced quickly, creating a large rotating population of domains. The infrastructure provider is not alleged to have authorised the scams. Operators exploit the convenience and reputation of widely used services while defenders try to distinguish legitimate hosted applications from abuse.
Simple domain blocking becomes less effective when an operation can create hundreds of fresh pages daily. The researchers focus on structural signals that persist across site changes, including common routing and content patterns. Such fingerprints are still subject to error and must be validated before a domain is treated as malicious, particularly when it sits beneath a shared hosting namespace.
The Eastern European connection is a relevant part of the attribution, but the full geographic distribution of victims is not established by the report’s infrastructure counts. Infoblox describes a global operation using US-hosted services and Russian-language criminal marketing. It would be misleading to claim that most victims are European without country-level evidence.
Remote desktop software creates a further attribution problem for victims and investigators. A tool can be legitimate in a maintenance contract yet become dangerous when a caller persuades an employee to install it outside an authorised workflow. Logs may show a familiar remote-access process rather than an obviously malicious executable. Infoblox’s account of the fraud therefore connects social engineering with ordinary administration functionality. The researchers’ evidence does not establish a single fixed payload or guaranteed sequence at every landing page, and it would be inaccurate to classify every visitor as having installed a remote-access program. The common pattern is the transition from deceptive support messaging to an attempted transfer of control.
The investigation also refers to plans discussed by the operator for forced browser extension installation. Those references indicate claimed intentions, not verified deployment of that capability. What the documented evidence does show is continuity: a fraud infrastructure active for years has changed delivery platforms without abandoning its underlying remote-access model.
