Infoblox Uncovers Help TDS Tech-Support Scam Network Using Free Web Hosting

Infoblox Threat Intel links the long-running operation to Russian-language affiliate program Hotejka, identifying more than 16,000 campaign domains before they are used.

Infoblox Threat Intel has linked the long-running Help TDS operation to Hotejka, a Russian-language affiliate program that researchers assess operates Help TDS and appears to be a rebrand of ROI777. Active since at least April 2017, the operation directs users to call centers where scammers persuade victims to install remote desktop software, potentially giving attackers access to their devices.

Unlike straightforward credit-card fraud, these campaigns rely on social engineering and remote access to exploit victims beyond the initial interaction.

How Help TDS Directs Victims to Scammers

A traffic distribution system (TDS) directs website visitors to different destinations based on factors such as their geographic location or device. Help TDS draws traffic from compromised websites, malicious advertisements, social media, and spam, routing users toward technical-support call centers.

Infoblox researchers traced the operation to a call center in June 2026. During the investigation, a fake support representative helped remove a browser lock and instructed the researchers to download UltraViewer, a free remote desktop application. Installing and granting access to such software could allow scammers to control a victim’s computer.

Renée Burton, VP of Infoblox Threat Intel, said tech-support scams have evolved beyond selling unnecessary antivirus services or stealing credit-card details.

“Today’s scams are complex social engineering attacks that give threat actors unfettered access to devices and the ability to continue to exploit the victim well past the initial phone call,” Burton said.

Free Hosting Helps Scale the Campaign

Since April 2026, Hotejka has reportedly used Cloudflare Pages to generate hundreds of pages each day. Infoblox Threat Intel identified more than 20,000 related domains over a six-month period, along with 10,000 pages that researchers believe were used for phishing or as decoys.

The researchers have also developed the ability to identify campaign domains approximately seven days before they are put to use. This early detection can help organizations block malicious infrastructure before users encounter it.

According to Infoblox, exposure among its cloud customers declined from as high as 4% on a single day to below 0.5% in September.

A Long-Running Threat Operation

Help TDS has persisted through multiple forms over several years, illustrating how traffic distribution infrastructure can support recurring fraud campaigns. By directing victims to call centers and encouraging remote-access software installation, the operation creates opportunities for attackers to maintain access and continue exploiting victims after the initial contact.

Infoblox’s findings highlight the importance of identifying malicious domains before activation and detecting the infrastructure used to route potential victims to fraudulent support operations.