Threat research is always a bit of a cat-and-mouse game, and it’s often made more so when an actor survives years in the face of scrutiny. The actors behind the so-called Help Traffic Distribution System (TDS) are one such case. They’ve been active since at least April 2017 and have been largely unaffected by the cybersecurity world around them. Help TDS delivers tech support scams (TSSs) that direct users to call centers, where social engineering is used to convince them to install remote desktop tools. It’s not simple credit card fraud: it’s remote access, living-off-the-land malware operations. Once in, the threat actor can exploit the victim time and again.
This is exactly the kind of case that gets under our skin.
Over the last year we’ve researched the identity of this actor and learned more about how their operations work. It turns out, they weren’t hiding at all.
We assess that Hotejka, a small Russian-language affiliate program, operates the TDS. Hotejka appears to be a rebrand of ROI777, an entity exposed in 2018 for similar activities. Their affiliates range from spam operators to website compromisers. Potential victims are redirected into the TDS from these affiliates via special URLs provided by Hotejka. The TDS then evaluates the user via browser fingerprinting and location to determine the course of action.
The device of their intended victims first displays a notice that an update is required and that their PC will restart. From there, regardless of what they choose to do, warnings that the machine has been disabled by Microsoft cover the screen. To further scare the device owner, Hotejka uses a “browser lock” that is difficult to escape and gives the sense that the machine is no longer operable. Alarms blare and a “Microsoft Security” phone number appears on the screen. A computerized voice track tells the user not to attempt to restart the computer, and that the computer lock is designed to stop illegal activity. It is jarring and compelling. See embedded video in Figure 1.
Figure 1. The initial lure from Help TDS (above); after this page, the tech support number will appear (below). Content warning: This video contains loud noises and strobe lighting.
Where other threat researchers stopped at the scareware, we called the number and recorded our interaction. The fake Microsoft employee eventually prompted us to download and install a free remote desktop tool, UltraViewer, which would give them complete access to our machine. It turns out that UltraViewer is itself interesting, but that’s a blog for another day.
We validated Hotejka’s role in these operations in many ways. Historical DNS records, loyal use of other affiliate advertising platforms over the years, and consistent command-and-control (C2) mechanisms give us a high degree of confidence that ROI777 and Hotejka are one and the same. We also have direct access to their affiliate panel, which includes the malicious WordPress plugin documented by GoDaddy, as well as previously unknown lures.
We found advertisements by Hotejka on Telegram and internet sites that showed criminal intent. They openly discussed their browser locks, call centers, and illicit traffic sources. Most recently, they announced plans for a new “forced browser extension installation.” See Figure 2.
Figure 2. Screenshot of a September 2026 announcement from Hotejka of a new “forced browser extension installation;” source: Telegram channel
Hotejka’s operations in 2026 leverage U.S. infrastructure from the comfort of their home, believed to be in Eastern Europe. As far as we can tell, the owner-operator hasn’t changed since originally reported in 2018. While they originally hosted their content on the notorious King Servers, the TDS and the tech support scams have been operated on free, disposable Cloudflare Pages (pages[.]dev) sites since April 2026. The threat actor creates hundreds of new pages a day. We detected over 20,000 such domains in a six-month period. Another 10,000 pages were created in what appear to be additional phishing or decoy operations.
Users are exposed to Help TDS through compromised domains, malvertising, social media posts, and spam. Across Infoblox Threat Defense cloud customers, up to 4% were exposed to Help TDS on a single day. While Hotejka isn’t the largest threat actor, they are also not small. Their end goal is the type of access that leads to information stealers, extortion, and more. So, this summer we set out to take away the actor’s advantage.
We sought to detect the domains before they were put into operation. The challenge was finding them in a sea of new sites. The volume of all new Cloudflare Pages easily exceeds 125,000 each day, and Hotejka is responsible for roughly 300 of them using several different domain generation algorithms.
Our data scientists love challenges like this. They reverse engineered the domain generation algorithms and found clever ways to mitigate false positives.
Today we detect new Cloudflare Pages configured by the threat actor about seven days before they’re used in Help TDS. Through mid-September, we’ve detected over 16,000 domains that Hotejka later used for the TDS. Our algorithms can now predict their domains effectively enough that less than 0.5% of our cloud customers were exposed in September. Additionally, through this research, we uncovered new decoy pages utilized by the operator, presumably to further disguise their operations.
Some of the domains used in Help TDS have appeared multiple times. While it is unclear whether this is due to a random result of their algorithm or deliberate operational tactics, we have seen several examples of repeated registration. Figure 3 shows an example of this lifecycle and our detections of one such domain, linen-thorn-wild[.]pages[.]dev over a two-month period.
Figure 3. The lifecycle and Infoblox detection of a sample Help TDS domain
Research like this is built on the strengths of others. We’d like to thank those who have published on Help TDS and its precursors in the past, especially GoDaddy’s Denis Singebuko, for their excellent contributions.
Help TDS, ROI777, and Hotejka
Help TDS (as it is called today) is a malicious TDS that has been operating in multiple forms since April 2017, possibly earlier. It is designed primarily to drive traffic to tech support scams conducted out of call centers. The technical nature of the TDS, including the malicious plugin they provide to their affiliates, has been covered in publications extensively. Our research focused on operator attribution, their affiliate program, and the call center operation itself. Figure 4 shows a composite timeline of major artifacts uncovered by various researchers, including us.
Figure 4. A timeline of various artifacts associated with Help TDS, ROI777, and Hotejka; the threat actor does not own all of these domains currently
In the simplest terms, Help TDS and its precursors are the routing decision infrastructure for a small affiliate program. Other threat actors, for example ones who have compromised websites, send potential victim traffic to the TDS through specially crafted URLs. Help TDS itself was originally implemented on a Keitaro server, and we believe it remains so today. Based on user fingerprinting, it will reroute the user to either the tech support scam or on to another affiliate marketing platform, which will in turn evaluate and resell the traffic. Thus, Hotejka is a publishing affiliate who sells so-called remnant traffic to other platforms. These downstream platforms often lead to scams and incorporate fake CAPTCHAs to induce users to accept push notifications in their browsers. To maintain a fresh set of TDS nodes, the operators use a C2 infrastructure that provides their affiliates with current domains; see Figure 5.
Figure 5. The Help TDS ecosystem, in which traffic is bought from affiliates and sold it to downstream programs
In its early days, the operator used roi777[.]com as the C2 infrastructure. This domain was connected to an affiliate program called ROI777, hosted in King Servers, and exposed repeatedly for malicious redirects. In March 2018, an anonymous researcher posted a detailed analysis of the tech support scams delivered through the affiliate network. At that time, the threat actor used “index” in their redirect URLs. GoDaddy coined the operation “Disposable TDS” for its reliance on Freenom, a now-defunct free domain registrar. Disposable TDS, operated by ROI777, is the precursor of Help TDS.
Also in March 2018, an unknown individual posted data that was obtained through a hack of ROI777 servers to pastebin[.]com. This included Telegram identities for several users, as well as campaign details indicating that the threat actor was using Keitaro servers and sending some traffic directly to a European affiliate advertising platform (platform #2 in Figure 4).
Although Hotejka claims publicly to have begun business in 2019, a wide range of evidence ties Hotejka directly to ROI777, which itself dates to at least 2017.
One of these pieces of evidence arises from Hotejka’s use of other affiliate advertising platforms. In our experience, Eastern European threat actors frequently send so-called remnant traffic to affiliate advertising programs to monetize unwanted traffic. The Malware Don’t Need Coffee blog included an IP address 162.244.35[.]33 that enabled us to verify the relationship between ROI777 and one of these platforms. In an early 2020 example, a visitor to the website varbani[.]com was redirected through the Disposable TDS after checking for the redirection path from roi-traffic[.]icu, the C2 domain at the time. In this example redirection chain, the affiliate ID for ROI777 is u=h2xkd0. In other words, h2xkd0 identities ROI777 sales of traffic to another affiliate program, the program listed as Affiliate Network #1 in Figure 4. This same affiliate ID, and one other, were used over several years and tied together multiple versions of the C2.
Hotejka/ROI777 has been loyal to the two affiliate platforms since 2017, and we believe that loyalty has paid handsomely. Using DNS volumes observed over the past 8 years, our ability to use affiliate IDs to track traffic over time, and commonly cited payout figures for affiliate advertising in general, we suspect that the two European programs have paid them at least a few million dollars (USD).
ROI777 was reported multiple times for their malicious activities in 2018-2019, including in a report by Akamai on 40,000 compromised machines that sent traffic to the TDS. They were also hacked and their data was dumped online. We suspect these events led to the rebranding from ROI777 to Hotejka.
The domain hotejka[.]com was registered in November 2019 and was used as the PTR record for the IP address 162.244.35[.]33 from early 2020 until the present day. This is the same IP address that hosted roi777[.]com until mid-March 2022, alongside many tech-support-scam-related domains. The thing to know about PTR records is that the person who controls the IP address establishes them; whoever controlled 162.244.35[.]33 and roi777[.]com set the record for hotejka[.]com as well.
The links between ROI777 and Hotejka are numerous; we won’t recount them all here. Hotejka established Telegram channels in late 2019. They began advertising on the open internet in September 2020, possibly earlier. The first web content we’ve seen is login pages, which include their Telegram channels, in November 2021. On the flip side, the login pages for ROI777, originally hosted on roi777[.]com and then on roi777[.]online, seem to disappear after January 2022. We suspect that in the first few years, Hotejka users logged in via the ROI777 portal.
While posting on different forums under different names, Hotejka has consistently advertised the same offer: a browser lock tech support scam operated through a call center with a smartlink that will deliver some content to the user, regardless of their location or device type. Throughout the years, they have consistently been open about accepting any kind of traffic. See Figure 6 for examples.
Figure 6. Screenshots of May 2026 advertisements from Hotejka on open forums
In 2025, Hotejka advertised using the moniker TipTop, the originally reported ROI777 operator’s Telegram handle. This posting on the forum zenno[.]club included graphs of call center volume and an offer of $20 per call. The post reads “We accept ANY traffic: email SPAM, Facebook, Taboola, shells, WP admin panels, doorway pages, etc.” A subsequent post says “More aggressive offers have been added to some GEOs, resulting in higher conversion rates and profits.” The poster then went on to specifically request traffic for France, Belgium, and Japan. In other offers, they regularly request U.S. victims. In May 2026, they offered $100 for the same traffic and further asked for web shells or admin panels. In the most recent advertisements, they expanded their targeting to include the USA, Canada, France, Sweden, Japan, and Australia. See Figure 7.
Figure 7. Screenshot of a Hotejka offer demonstrating call center volumes; some of their advertisements claim that affiliates can earn $20-30k USD per day
In mid-September 2026, Hotejka advertised on their Telegram channel (hotejka_hot) that in addition to their mainstream smartlink and tech support offer, they would soon launch a new monetization system that was based on a forced browser extension installation. It is unclear how this offer would work, but the threat actor has already demonstrated their ability to scare users via locked browsers for years. See Figure 2.
The mainstream smartlink that these advertisements boast are, in reality, provided by a different affiliate advertising platform (#2 on Figure 4). We acquired an account on this same platform and discovered that Hotejka was the fourth most profitable affiliate of theirs in July 2026. This further supports our estimation that ROI777/Hotejka has earned millions of dollars over the years through their operations.
So, who sends traffic to Help TDS? We’ve identified about 20 different affiliates in 2026. The bigger-name ones are Balada Injector, Detour Dog, and DollyWay, all of whom have been Hotejka affiliates for many years. Balada Injector had been dormant since December 2024 following the pause of push monetization at Hotejka’s affiliate advertising partner (platform #1 in Figure 4) but came back with a vengeance in May 2026.
While we often think of Hotejka affiliates as WordPress malware actors, there are many others using different methods to drive traffic. In June 2026 we observed an affiliate advertising a Telegram bot called “Your Free AI Assistant” (freeassistant_bot). After we communicated with the bot, it began delivering advertisements that when clicked, led us to Help TDS. See Figure 8.
Figure 8. Screenshot of a Hotejka affiliate using a Telegram bot called Your Free AI Assistant to drive traffic to Help TDS; this was captured June 26, 2026
The Call Center Experience
Although the tech support scams delivered by Help TDS and its predecessors have been reported repeatedly over the last eight years, we couldn’t find any information about the call center operation itself. What exactly happened when the victim called? Is it a pesky credit card theft, or did the operation involve malware installation? We decided to find out.
In mid-June 2026, we visited a compromised website from a research machine, received the browser lock, and called the number.
We dialed 855-616-3518 and recorded the entire encounter. You can listen to it here:
In a nutshell, our call was routed to what seemed to be a busy center with lots of background chatter. The experience went like this:
- The receiver identified himself as Microsoft Technical Support and repeatedly emphasized that there would be no charge for the service.
- He asked several questions, including whether this was a personal or work device, and how we encountered the browser lock.
- He guided us to use ctrl-alt-delete to logout and log back in again, removing the lock.
- Finally, he asked us to open the Start window, navigate to ultraviewer[.]net and download the remote access software.
- After questioning the need to download additional software when Windows Defender was already installed, the call was disconnected.
During the call, we were put on hold several times. We think this is a screening mechanism and that they are possibly trying to validate the caller during this time.
UltraViewer is free remote desktop software that would give the attacker full access to our system. Of course, we wanted to know more about it. Our research into the abuse of this software led to a whole new set of discoveries, which we will publish in a subsequent blog.
The Role of Cloudflare Pages
Cloudflare Pages allows the free, unlimited creation of serverless applications hosted with Cloudflare. This affords the developer the reliability of Cloudflare services. In particular, pages[.]dev sites inherit the enterprise-grade bot detection developed by Cloudflare to prevent automated scraping. Malicious actors take advantage of the free, easy-to-use, highly reliable and secure services for a wide range of activities, including phishing and scams. The abuse of Cloudflare Pages at-scale is nothing new.
The service is extremely popular. We typically observe over 125,000 new subdomains of pages[.]dev every day, often many more. Since April 2026, the Help TDS Telegram channel has updated the current C2 set every five minutes: they announce nearly 300 new Cloudflare Pages daily. Each of these domains resolves in DNS for approximately one week.
When you create Cloudflare Pages, you choose the subdomain. So, when deploying hundreds of sites a day, you are likely to create some kind of pattern. The TDS operator seems to be conscious of this and uses a number of different naming conventions. Given the extraordinary volume of Cloudflare Pages created daily around the world, the ability to isolate their naming fingerprints with a high degree of assurance is low. But this is exactly what we’ve done.
We’re not going to share the details of our detection system; however, we will share some statistics and observations about the actor’s use of Cloudflare. We implemented this algorithm in July. Since then, we’ve identified over 10,000 instances of a likely Help TDS domain before it was announced on the Telegram channel. On average this occurred seven days in advance; that is also our median advance warning.
The threat actor continues to modify their system, and we’ll continue to modify ours as long as they are in business. In the last six months, the actor has used a dozen different domain generation algorithms; half of them are being used extensively. The naming patterns can easily overlap with other users of the service, adding additional challenges.
While they announce 300 new domains daily for their TDS, it appears they create a lot more Pages than are used and the daily tempo varies. In total, we’ve detected ~30,000 domains, only about 16,000 of which were announced on their Telegram channel.
The actor has incorporated decoy pages that are shown when scanned directly. For example, the domain sun-sky-calm[.]pages[.]dev featured the decoy advertisement on the left side of Figure 9. We detected that domain as Help TDS on September 8, and it was included in the Telegram channel as a C2 on September 11. Other decoys include the impersonation of Ledger within an advertisement for a fake financial application.
Figure 9. Screenshots of Help TDS decoy pages; the domains that showed these pages later were included in the Telegram channel that announces new C2 domains for Hotejka affiliates
We have seen a curious reuse of domains by the actor as well. It’s curious because they use multiple domain generation algorithms, which in theory should create millions of unique domains, and yet we have seen multiple cases where the same domain name is used in two different time periods. This could be due to a poor implementation that leads to random “collisions” in the generated domains, or they could be attempting to “warm” domains, so they won’t be caught later when used for the TDS.
For example, linen-thorn-wild[.]pages[.]dev was first seen in DNS on August 4, and we detected it as Help TDS on August 6, with the configured nameservers:
- ligia.ns.cloudflare[.]com
- coleman.ns.cloudflare[.]com
The actor announced the domain on their Telegram channel ten days later. The domain was used for a single day and then reappeared on September 10 using a different set of Cloudflare nameservers. We detected the domain as Help TDS for a second time on September 10, and it was announced on the Telegram channel on September 20. This example was shown earlier in Figure 3.
When Help TDS first moved their operations to Cloudflare Pages, we saw up to 4% of our cloud customers exposed to Help TDS on a single day. While these numbers might not seem large, it shows that Help TDS, often through affiliates who compromise websites, but also through malvertising, social media, and spam distribution, can reach a wide range of organizations.
With the new detectors in place, the current exposure for our cloud customers to Help TDS is around 0.5%. Some of this exposure is due to misconfigured response policy zones (RPZs).
Hotejka CNAME Affiliates and On1x VPN
Some domains do not traverse Help TDS but instead use a DNS CNAME mapping to redirect via DNS to an actor-controlled server. The Hotejka affiliate sets a DNS record at their provider which points their domain, e.g., fosetya[.]shop to hotcname[.]help, the domain controlled by Hotejka. When user traffic is sent to the affiliate domain, it is transparently redirected, via DNS, to the Hotejka server.
On September 21, 2026, we recorded a version of this behavior in which the domain lib1[.]biz hosted with Trellian’s “zero click” parking service redirected multiple times and eventually landed at a Hotejka tech support scam page on the domain fosetya[.]shop, which itself has a CNAME record to hotcname[.]help. In this instance, the traffic was sold from Trellian to an affiliate advertising platform based in Cypress, which in turn sold the click to Hotejka for $0.065. See Figure 10. This is a concrete example of the danger of today’s “direct search” or “zero click” parking models, as we published in December 2025.
Figure 10. A parked domain lib1[.]biz is redirected through Trellian’s zero click parking service to an advertiser and eventually lands at a Hotejka-hosted tech support scam via a DNS CNAME mapping
The domain hotcname[.]help has resolved to about 20 different IP addresses over the last year, most recently 91.196.33[.]144 (AS20797 SERV.HOST). This ASN is tied to a Russian-language dedicated hosting provider (serv[.]host) whose registration records include a London, UK address.
This same IP address (91.196.33[.]144) hosts the domains usa.on1xvpn[.]com and usa.on1xvpn[.]ru, and nothing else. Based on these domains, the IP appears to be an endpoint for On1x VPN, a Russian language VPN service which allows users to subscribe via Telegram. The .ru domain was originally hosted in the now-sanctioned Aeza networks, and the .com domain was first registered in June 2026. The VPN service appears to provide subdomains to users and the “usa” hostname directly connected to Hotejka and the tech support scams. It is unclear if there is any other relationship between the On1x VPN and Hotejka.
Hotejka Offerings
The Hotejka affiliate offerings include the lure that we encountered in the wild (shown in Figure 1), in which we were told an update was required. But they offer affiliates other options as well. As shown in Figure 11, Hotejka offers affiliates multiple ways to funnel the traffic and qualify potential victims for the call centers. Affiliates can add code to a site they control through the WordPress theme editor, a plugin, or a custom HTML block.
Figure 11. The Hotejka affiliate panel offers three kinds of lures which create a funnel to identify real users for call center operations
The code does the following:
- Resolves the current C2 domain by checking the Telegram channel and extracting the last listed domain
- If that fails, it uses a URL hosted at pinkfels[.]shop to extract the most recent domain from the returned JSON
- Caches the result in a base64 encoded file and refreshes it every 30 seconds
- Builds a URL using the affiliates ID that is hardcoded into the PHP
- Gates the popup display to U.S. working hours so that the user will only be driven to a call center Monday through Friday, from 9am to 6pm EDT
- Computes this time gate using Moscow time, so the lure is only shown 16:00-00:59 MSK
- Displays a fake captcha or the “update required” lure
The WordPress plugin was previously documented by GoDaddy, but to our knowledge, the lures themselves have not been documented in the past. This panel definitively connects Help TDS and the malicious plugin to Hotejka. Combined with the evidence we obtained via DNS and other sources, we are highly confident that Hotejka is the current operator of Help TDS and runs the affiliate program used by some of the most prolific website malware actors: Detour Dog, Balada Injector, and DollyWay.
Indicators
A selection of indicators related to Help TDS and Hotejka.
Telegram Channels, Handles, and Bots
- trafficredirect – C2 channel to announce new Help TDS domains
- hotejka_hot – Hotejka channel
- hotejka_support – Hotejka support account
- hot2_support – Hotejka support account
- hotejka, hotejka_admin – Hotejka accounts
- freeassistant_bot – affiliate Telegram bot
Hotejka Domains and IP Addresses
- hotejka[.]ink – primary affiliate site
- hotns[.]rest – nameserver
- hotcname[.]help – CNAME used by affiliates for DNS redirection
- usa.on1xvpn[.]com – Hotejka On1x VPN endpoint
- 62.113.117[.]248 – VDSINA VDS Hosting AS48282
- 91.196.33[.]144 – SERV.HOST GROUP LTD AS207957
Hotejka Affiliate Domains
- zylvantrexor[.]lol, fosetya[.]shop, goalods[.]lol, trixsolvesxa[.]shop
Help TDS Domains on Cloudflare Pages
- arrow-berry-gem.pages[.]dev
- ashen-drift-stone.pages[.]dev
- solar-cloud-branch.pages[.]dev
Call Center Phone Numbers Observed
- +1 855-616-3518
- +1 855-361-0064
- +1 844-959-1966
