Infoblox has linked Help TDS, a traffic distribution system active since at least 2017, to Hotejka, a Russian-language affiliate program that appears to be a rebrand of ROI777. Help TDS routes visitors from compromised websites to tech support scams, using browser fingerprinting and location data to decide which scam or affiliate platform to send them to.
Victims are presented with fake Windows security alerts that claim their machine has been locked and tell them not to restart the computer. Those who call the displayed support number are instructed to install a remote desktop tool such as Ultraviewer, giving the attacker full control of the machine. The TDS also passes traffic to other affiliate platforms that lead to push-notification spam and fake CAPTCHA pages.
Since April 2026, the scams have been hosted on free Cloudflare Pages subdomains, with the operator creating roughly 300 disposable pages per day and more than 20,000 domains in total. Infoblox says historical DNS records, consistent command-and-control mechanisms, and the past use of roi777.com as a C2 domain give it high confidence that ROI777 and Hotejka are the same operation. Hotejka's Telegram channel advertises forced browser extension installs and tech support landing pages that are 'very difficult to exit.'