A large tech support scam operation is using more than 20,000 Cloudflare Pages domains to redirect internet users to fake Microsoft security alerts and fraudulent call centers. The campaign combines traffic filtering, disposable web infrastructure, compromised websites, and social engineering to convince victims that their computers are infected or disabled. Instead of delivering a custom malware payload in every case, the attackers try to persuade victims to install legitimate remote access software and hand over control of their computers.
Infoblox researchers detailed the campaign in a report published on October 15. Their investigation links the operation, which uses a traffic distribution system called Help TDS, to Hotejka, a Russian-language affiliate program. The operation has existed since at least April 2017, but its infrastructure has evolved to support large-scale campaigns using rapidly changing domains and automated traffic routing.
The attack begins when a visitor reaches a website through a malicious advertisement, spam message, social media post, or compromised legitimate website. Help TDS evaluates the visitor’s browser details and geographic location before deciding whether to display normal content or redirect the visitor to a scam page. This selective delivery makes the campaign harder to identify because not everyone visiting the same website necessarily sees the malicious content.
The final destination displays a fake Microsoft security warning that claims the computer has been blocked because of a serious problem. Some pages play loud alarms and use browser-locking techniques to prevent users from easily dismissing the message. These techniques create the impression that the operating system itself has stopped working, even though the warning is being displayed inside a web browser.
The objective is to make victims call a phone number shown on the page. An operator then poses as a Microsoft support technician and guides the victim through steps that can give the scammer remote access to the computer.
Infoblox tested one of the call centers in June 2026. The operator asked whether the computer belonged to an individual or a business, helped remove the browser lock, and then instructed the researchers to download UltraViewer. UltraViewer is a legitimate remote desktop application, not a malware payload created by the attackers. However, once a victim installs the software and allows a remote connection, the operator may be able to interact with the system and attempt to access files, credentials, or other sensitive information.
This method reduces the need for the attackers to exploit a software vulnerability directly. The browser warning creates urgency, the call center establishes trust, and the remote access tool provides a way to interact with the victim’s computer. What appears to be a technical support session can therefore become the most important stage of the attack.
How Help TDS keeps the scam running
The technical infrastructure behind the campaign is designed to make individual domain takedowns less effective. Since April 2026, the operators have hosted their traffic distribution and scam pages on Cloudflare Pages, a legitimate service for deploying websites. Infoblox identified more than 20,000 Pages domains associated with the core operation, along with another 10,000 domains apparently connected to phishing or decoy activity.
The operators reportedly announce around 300 new domains each day through Telegram. This gives them a large pool of replacement destinations if existing domains are blocked or taken down. The scale should not be confused with the number of compromised customer accounts. These figures describe domains associated with the campaign, not 20,000 separate victims or confirmed Cloudflare account breaches.
Help TDS also uses dynamic routing instead of relying on a fixed destination embedded in every page. The system retrieves current routing domains from Telegram and refreshes its cached results every 30 seconds. If the primary routing server becomes unavailable, it can use a fallback server. The operators can also configure the system to display scam content during call center working hours.
These features are important because they separate the websites that attract visitors from the infrastructure that decides where those visitors go. A security team might block one malicious domain, only for the traffic distribution system to send users to another. The use of decoy pages adds another layer of difficulty because some domains may display harmless advertisements during direct inspection instead of exposing their malicious purpose.
Infoblox also connected Hotejka to the older ROI777 operation using historical DNS records, shared infrastructure, affiliate identifiers, and access to an affiliate panel. The investigation identified about 20 affiliates associated with the wider ecosystem, including Balada Injector, Detour Dog, and DollyWay. These connections suggest that the campaign relies on a broader network of traffic sources and website infections rather than a single group operating a collection of isolated scam pages.
Compromised WordPress websites are particularly relevant to this model. Previous investigations have documented malicious PHP templates and WordPress plugins that redirect visitors from legitimate sites to fraudulent destinations. Website owners may not notice the redirects, while visitors are more likely to trust a page because they arrived from a familiar publication or business.
Why blocking individual domains may not be enough
Cloudflare Pages is not inherently malicious. It is a legitimate hosting platform, and the presence of a Pages domain alone does not prove that a website is dangerous. The challenge is identifying abuse quickly without blocking legitimate projects that use the same service.
The campaign also shows why traditional blocklists can struggle against rapidly changing infrastructure. A list of known malicious domains becomes less useful when hundreds of new destinations appear each day. Defenders need to identify relationships between domains, routing code, DNS records, hosting patterns, affiliate identifiers, and other infrastructure signals. Disrupting the traffic distribution system and its control mechanisms may have a broader effect than removing individual landing pages.
Infoblox says its detection models can identify related domains around seven days before they are used. The company reported that exposure among its cloud customers fell from daily peaks of 4% to below 0.5% in September. These are figures from its own customer environment, not confirmed infection rates across the internet, but they indicate that early identification can help reduce exposure.
For users, the main warning sign is a webpage claiming that Microsoft has locked the computer and demanding a phone call. Users should not call numbers displayed in unsolicited security alerts or install remote access software at the request of an unknown support agent. Microsoft branding, loud alarms, and a browser that appears frozen do not establish that the computer has been compromised.
If a suspicious page prevents normal browsing, users can try closing the browser or ending its process through the operating system’s task manager. Anyone who has already allowed a stranger to connect remotely should disconnect the computer from the internet, remove the remote access software, check for unauthorised changes, and secure potentially exposed accounts from a trusted device.
The Help TDS campaign demonstrates how criminals can combine ordinary web hosting, automated traffic routing, compromised websites, and human-operated call centers into a resilient scam operation. The technical infrastructure gets victims to the right page, but social engineering remains the key to gaining access. That combination makes the campaign harder to stop with domain blocking alone and shows why both infrastructure-level detection and user awareness remain necessary.
Related Posts
