Infoblox Threat Intel has detected more than 20,000 domains over a six-month period linked to a long-running malicious traffic distribution system known as Help TDS, which redirects unsuspecting internet users to fraudulent tech-support websites.

Researchers also uncovered roughly 10,000 additional pages used for decoys and phishing as part of the same operation, which they assess is run by a Russian-language affiliate programme known as Hotejka, active since at least April 2017 and likely a rebrand of an earlier operation called ROI777.

How the scam operates

Help TDS functions as a smart routing mechanism, directing visitors to scam destinations based on their location and device signals. Victims typically encounter realistic warnings of device disablement, blaring alarms and fake “browser locks” designed to scare them into calling illegitimate support centres, where scammers persuade them to install remote desktop tools that grant full access to their devices.

In June 2026, Infoblox researchers followed the chain to one such call centre, where a fake support employee helped “remove” a browser lock before directing them to download a remote desktop tool that would have given scammers full control of the computer.

“Often people associate tech support scams with unnecessary antivirus services and nuisance credit card theft,” said Renée Burton, Vice President of Infoblox Threat Intel. “Today’s scams are complex social engineering attacks that give threat actors unfettered access to devices and the ability to continue to exploit the victim well past the initial phone call.”

A persistent, fast-moving operation

Since April 2026, Hotejka has used Cloudflare Pages to create hundreds of new scam pages daily, with Infoblox now identifying related domains roughly seven days before they are used in attacks. That early detection has helped cut exposure among Infoblox’s cloud customers from as much as 4 per cent on a single day to less than 0.5 per cent by September.