Infoblox Threat Intel has linked a tech-support scam operation that has run since 2017 to more than 20,000 domains seen over the past six months, many of them built on free Cloudflare Pages hosting.
The researchers call the operation Help TDS. A traffic distribution system routes visitors to different destinations based on signals such as location or device, and Help TDS sends traffic from compromised websites, malicious adverts, social media and spam to tech-support call centres. Infoblox assesses that Hotejka, a Russian-language affiliate programme that appears to be a rebrand of ROI777, runs it. Affiliates are offered up to $100 for driving traffic to the fraudulent sites.
Since April 2026 the group has used Cloudflare Pages to create hundreds of pages a day. Infoblox counted more than 20,000 related domains in six months, plus 10,000 pages that appear to be used for phishing or as decoys. Visitors meet fake Microsoft security alerts, blaring alarms and browser locks designed to frighten them into phoning a support centre.
In June 2026 Infoblox researchers followed the chain to one of those call centres. A fake support employee helped remove a browser lock and then directed them to download UltraViewer, a free remote desktop tool that would have handed the scammers full access to the computer.
Renée Burton, VP of Infoblox Threat Intel, said the picture is more serious than many people assume: “Often people associate tech support scams with unnecessary antivirus services and nuisance credit card theft. Today’s scams are complex social engineering attacks that give threat actors unfettered access to devices and the ability to continue to exploit the victim well past the initial phone call.”
Infoblox said it can now identify domains about seven days before the group uses them, and that it detected more than 16,000 campaign domains before use. Among Infoblox cloud customers, exposure fell from peaks of up to 4% on a single day to less than 0.5% in September. The full research is published on the Infoblox threat intelligence blog.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
