Infoblox Threat Intel links the long-running operation to Hotejka and detected more than 16,000 campaign domains before use
DUBAI, UAE, October, 2026: Threat research is often a cat-and-mouse game when an actor survives scrutiny. The actors behind Help TDS are one such case. Infoblox assesses that Hotejka, a Russian-language affiliate program, operates Help TDS and appears to be a rebrand of ROI777. Active since at least April 2017, it sends users to call centers that persuade victims to install remote desktop tools. This is not simple credit-card fraud.
A traffic distribution system, or TDS, routes visitors to different destinations based on signals such as location or device (Learn more about TDSs here). Help TDS sends traffic from compromised sites, malicious ads, social media and spam to tech-support call centers. Its persistence is unique: the operation has survived in multiple forms for years.
In June 2026, Infoblox researchers followed the chain to a call center. A fake support employee helped remove a browser lock and directed them to download UltraViewer, a free remote desktop tool that would have given the scammers full access to the computer.
Renée Burton, VP Infoblox Threat Intel, says: “Often people associate tech support scams with unnecessary antivirus services and nuisance credit card theft. Today’s scams are complex social engineering attacks that give threat actors unfettered access to devices and the ability to continue to exploit the victim well past the initial phone call.”
Since April 2026, Hotejka has used Cloudflare Pages to create hundreds of pages daily. Infoblox Threat Intel detected more than 20,000 related domains in six months, plus 10,000 pages apparently used for phishing or decoys. The researchers now identify domains about seven days before use. Exposure among Infoblox cloud customers fell from up to 4% on one day to less than 0.5% in September.
Photo Caption: Renée Burton, VP Infoblox Threat Intel
About Infoblox Threat Intel:
Infoblox Threat Intel is the leading creator of original DNS threat intelligence, distinguishing itself in a sea of aggregators. What sets us apart? Two things: mad DNS skills and unparalleled visibility. DNS is notoriously tricky to interpret and hunt from, but our deep understanding and unique access to the internet’s inner workings allows us to track down threat actors that others can’t see. We’re proactive, not just defensive, using our insights to disrupt cybercrime where it begins. We also believe in sharing knowledge to support the broader security community by publishing detailed research and releasing indicators on GitHub. In addition, our intel is seamlessly integrated into our Infoblox DNS Detection and Response solutions, so customers automatically get its benefits, along with ridiculously low false positive rates.
About Infoblox:
Infoblox is a leading platform for preemptive security and hybrid, multi-cloud networking that delivers enterprise resilience and agility. Trusted by over 5,700 customers, including the majority of Fortune 100 companies as well as emerging innovators, we seamlessly integrate, secure and automate critical network services so businesses can move fast without compromise. Visit Infoblox.com, or follow us on LinkedIn.
