Infoblox links Help TDS scams to Hotejka and Cloudflare Pages abuse

Infoblox has linked Help TDS, a system that routes visitors to scams, to the Russian-language affiliate program Hotejka. Its findings identify over 20,000 Cloudflare Pages domains used for tech support scams since April 2026, with the operator creating roughly 300 disposable pages per day. Affiliates send visitors from compromised websites into the routing system, which uses browser and location information to choose destinations. Fake Windows security alerts then direct victims to call centers, where operators persuade them to install remote desktop tools. Infoblox assesses Hotejka to be the same operation as ROI777, citing historical DNS records and consistent command infrastructure.