# Infoblox links Help TDS scams to Hotejka and Cloudflare Pages abuse

_Published Thursday, October 15, 2026 at 11:49 AM EDT · Security · Latest · Tier 2 — Notable_

![Infoblox links Help TDS scams to Hotejka and Cloudflare Pages abuse — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgp2enQeK-5xZuEo_rLQje9W_odynVLALJCEvTyaMSolIfwVonZGMceQWA8yq9xPMD-C_RkIp-V03EqEBVTM5yMq9IHWRRfSHxWWDS6kCJVcVAsmlFXt5wD2pK7Bk-A6iBIDFS2o811n8e48B1Psni_qvrkJ0HMXtJlhaLwx7jkxEG-e0XDgtcAMUMLiNFV/s1700-nu-rw-lo-l85-e365/hot.jpg)

Infoblox has linked Help TDS, a system that routes visitors to scams, to the Russian-language affiliate program Hotejka. Its findings identify over 20,000 Cloudflare Pages domains used for tech support scams since April 2026, with the operator creating roughly 300 disposable pages per day.

Affiliates send visitors from compromised websites into the routing system, which uses browser and location information to choose destinations. Fake Windows security alerts then direct victims to call centers, where operators persuade them to install remote desktop tools. Infoblox assesses Hotejka to be the same operation as ROI777, citing historical DNS records and consistent command infrastructure.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/help-tds-linked-to-hotejka-as-20000.html)

---
Canonical: https://techandbusiness.org/newswire/pXyugTNV01M5jQReRE4dtg
Published: 2026-10-15T15:49:12.160Z
Story chronology: 2026-10-15T14:11:36.000Z
Retrieved: 2026-10-15T19:00:46.653Z
Publisher: Tech & Business (techandbusiness.org)