/
← Voltar ao feed
medium

Hotejka (ex-ROI777) runs Help TDS tech support scam network using thousands of disposable Cloudflare Pages domains

1 fonte(s) · 1 atualização(ões) · publicado 15/10/2026 10:00 · coletado há 10 horas

Infoblox attributes the long-running Help TDS traffic distribution system, active since at least April 2017, to Hotejka, a small Russian-language affiliate program that appears to be a rebrand of ROI777 (exposed in 2018). The TDS fingerprints visitors and redirects them to browser-lock tech support scams that push victims to call centers, where operators pose as Microsoft support and have them install the remote desktop tool UltraViewer. Since April 2026 the operation has run on free, disposable Cloudflare Pages (pages[.]dev) sites, with about 300 new C2 domains announced daily via Telegram. Infoblox reports ~30,000 domains detected, about 16,000 of them announced, and says its predictive detection flags them roughly seven days before use, cutting customer exposure from up to 4% to about 0.5%. Hotejka is assessed to have earned at least a few million USD through two European affiliate ad platforms, and in September 2026 it announced a planned "forced browser extension installation" monetization offer.

Technical Details

  • Attribution: Based on historical DNS, hotejka[.]com as the PTR record for 162.244.35[.]33 (which previously hosted roi777[.]com), reuse of affiliate IDs (e.g. u=h2xkd0) across C2 versions, and Telegram/forum advertising. Infoblox also reports access to the affiliate panel, which includes the malicious WordPress plugin previously documented by GoDaddy.
  • Traffic sources: About 20 affiliates in 2026, including Balada Injector, Detour Dog and DollyWay (compromised WordPress sites), plus malvertising, spam, social media and a Telegram bot ("Your Free AI Assistant", freeassistant_bot). Hotejka accepts any traffic and offers $20-$100 per call; targeted geos include the USA, Canada, France, Sweden, Japan and Australia.
  • TDS logic: Believed to run on Keitaro. Non-target traffic is resold as remnant traffic to downstream affiliate platforms (scams, fake CAPTCHAs, push notification abuse).
  • Infrastructure: A dozen domain generation algorithms in six months, with decoy pages shown to scanners (e.g. sun-sky-calm[.]pages[.]dev, a fake Ledger-themed ad). Some domains are reused (e.g. linen-thorn-wild[.]pages[.]dev), possibly domain "warming". Each domain resolves for about a week.
  • CNAME affiliates: Affiliate domains such as fosetya[.]shop CNAME to hotcname[.]help, which resolves to 91.196.33[.]144 (AS20797 SERV.HOST). The same IP hosts usa.on1xvpn[.]com and usa.on1xvpn[.]ru (On1x VPN); any relationship to Hotejka is unclear. A Sept 21, 2026 chain went from parked domain lib1[.]biz via Trellian zero-click parking to a Hotejka scam page; the click sold for $0.065.
  • Call center: Number 855-616-3518. The agent claimed to be Microsoft support, removed the lock via ctrl-alt-delete and directed the researchers to ultraviewer[.]net.
  • The article is truncated; details on affiliate lure options are incomplete.

Remediation

  • Block or monitor newly created pages[.]dev domains matching Help TDS naming patterns, and use predictive or protective DNS detection.
  • Review RPZ configurations for gaps that allow exposure.
  • Educate users that browser-lock pop-ups and "Microsoft" phone numbers are scams, and restrict installation of unapproved remote access tools such as UltraViewer.
  • Patch and harden WordPress sites to prevent their use as affiliate traffic sources.

Linha do tempo

  1. infoblox.com ↗ · pub. 15/10/2026 10:00 · coletado 20/10 16:31 primeiro registro

    Hotejka (ex-ROI777) runs Help TDS tech support scam network using thousands of disposable Cloudflare Pages domains

    ler a análise desta fonte

    Infoblox attributes the long-running Help TDS traffic distribution system, active since at least April 2017, to Hotejka, a small Russian-language affiliate program that appears to be a rebrand of ROI777 (exposed in 2018). The TDS fingerprints visitors and redirects them to browser-lock tech support scams that push victims to call centers, where operators pose as Microsoft support and have them install the remote desktop tool UltraViewer. Since April 2026 the operation has run on free, disposable Cloudflare Pages (pages[.]dev) sites, with about 300 new C2 domains announced daily via Telegram. Infoblox reports ~30,000 domains detected, about 16,000 of them announced, and says its predictive detection flags them roughly seven days before use, cutting customer exposure from up to 4% to about 0.5%. Hotejka is assessed to have earned at least a few million USD through two European affiliate ad platforms, and in September 2026 it announced a planned "forced browser extension installation" monetization offer.

    Technical Details

    • Attribution: Based on historical DNS, hotejka[.]com as the PTR record for 162.244.35[.]33 (which previously hosted roi777[.]com), reuse of affiliate IDs (e.g. u=h2xkd0) across C2 versions, and Telegram/forum advertising. Infoblox also reports access to the affiliate panel, which includes the malicious WordPress plugin previously documented by GoDaddy.
    • Traffic sources: About 20 affiliates in 2026, including Balada Injector, Detour Dog and DollyWay (compromised WordPress sites), plus malvertising, spam, social media and a Telegram bot ("Your Free AI Assistant", freeassistant_bot). Hotejka accepts any traffic and offers $20-$100 per call; targeted geos include the USA, Canada, France, Sweden, Japan and Australia.
    • TDS logic: Believed to run on Keitaro. Non-target traffic is resold as remnant traffic to downstream affiliate platforms (scams, fake CAPTCHAs, push notification abuse).
    • Infrastructure: A dozen domain generation algorithms in six months, with decoy pages shown to scanners (e.g. sun-sky-calm[.]pages[.]dev, a fake Ledger-themed ad). Some domains are reused (e.g. linen-thorn-wild[.]pages[.]dev), possibly domain "warming". Each domain resolves for about a week.
    • CNAME affiliates: Affiliate domains such as fosetya[.]shop CNAME to hotcname[.]help, which resolves to 91.196.33[.]144 (AS20797 SERV.HOST). The same IP hosts usa.on1xvpn[.]com and usa.on1xvpn[.]ru (On1x VPN); any relationship to Hotejka is unclear. A Sept 21, 2026 chain went from parked domain lib1[.]biz via Trellian zero-click parking to a Hotejka scam page; the click sold for $0.065.
    • Call center: Number 855-616-3518. The agent claimed to be Microsoft support, removed the lock via ctrl-alt-delete and directed the researchers to ultraviewer[.]net.
    • The article is truncated; details on affiliate lure options are incomplete.

    Remediation

    • Block or monitor newly created pages[.]dev domains matching Help TDS naming patterns, and use predictive or protective DNS detection.
    • Review RPZ configurations for gaps that allow exposure.
    • Educate users that browser-lock pop-ups and "Microsoft" phone numbers are scams, and restrict installation of unapproved remote access tools such as UltraViewer.
    • Patch and harden WordPress sites to prevent their use as affiliate traffic sources.