Infoblox counted more than 20,000 scam-related pages.dev domains over six months. It says they are tied to a traffic-routing system it calls Help TDS. The full picture shows how compromised websites, junk ads and human call centers fit together into one business. It also shows how to get out of the trap and why blocking known addresses can't keep up.
What Infoblox found
Infoblox published its findings on October 15, 2026. Researchers there tie Help TDS to a Russian-language affiliate program. "We assess that Hotejka, a small Russian-language affiliate program, operates the TDS. Hotejka appears to be a rebrand of ROI777, an entity exposed in 2018 for similar activities." The company says its confidence rests on "historical DNS records, loyal use of other affiliate advertising platforms over the years, and consistent command-and-control (C2) mechanisms." Infoblox also says it has direct access to Hotejka's affiliate panel.
This is a long-running operation. Techlomedia, summarizing the research, notes that it has existed since at least April 2017, but its infrastructure has evolved to support large-scale campaigns using rapidly changing domains and automated traffic routing. Gridinsoft's analysis adds that the attribution is the researchers' attribution assessment; it does not establish state sponsorship. "Russian-language criminal affiliate program" is the accurate description. "Kremlin operation" would not be.
The headline numbers measure different things:
| Figure | What it measures |
|---|---|
| 20,000+ | pages.dev domains tied to Help TDS over six months |
| ~10,000 | Additional Pages domains that appear to be phishing or decoys |
| ~300/day | New Pages domains announced by the operator each day |
| 125,000+/day | All new pages.dev subdomains Infoblox typically sees, from everyone |
| ~30,000 | Total domains Infoblox detected; only about 16,000 were announced on Telegram |
A press release distributed by Infoblox states that since April 2026, Hotejka has used Cloudflare Pages to create hundreds of pages daily, and Infoblox Threat Intel detected more than 20,000 related domains in six months, plus 10,000 pages apparently used for phishing or decoys.
These are domain counts, not victim counts. Twenty thousand pages does not mean twenty thousand infected PCs.
Section summary: A known scam operation, now attributed to Hotejka, uses about 300 throwaway Cloudflare Pages sites a day to show fake Microsoft warnings. Cloudflare was not hacked. The scammers simply use the free service.
Cloudflare wasn't breached
This is abuse of a legitimate service, not a security failure at Cloudflare. In Gridinsoft's words, it is abuse of a hosting service, not evidence that Cloudflare itself was breached or that every pages.dev address is malicious. Developers who host real projects on pages.dev haven't done anything wrong. Blocking the whole domain would cause a lot of collateral damage.
The scam's real advantage is volume. Infoblox's own write-up says each announced domain resolves in DNS for about a week. The operator's Telegram channel updates the current list of command-and-control domains every five minutes. Gridinsoft sums up the result: roughly 300 newly announced Pages domains per day, against more than 125,000 new Pages subdomains Infoblox typically observes daily across the service. Blocking one visible address therefore leaves the routing operation with replacements.
How an ordinary visit ends on a fake Windows screen
A Traffic Distribution System is the scam's sorting desk. "Help TDS and its precursors are the routing decision infrastructure for a small affiliate program," Infoblox explained. "Other threat actors, for example ones who have compromised websites, send potential victim traffic to the TDS through specially crafted URLs."
Traffic comes from many places. The attack begins when a visitor reaches a website through a malicious advertisement, spam message, social media post, or compromised legitimate website. The investigation identified about 20 affiliates associated with the wider ecosystem, including Balada Injector, Detour Dog, and DollyWay. Those are well-known names in WordPress malware. Infoblox says Hotejka's affiliate panel includes a malicious WordPress plugin that GoDaddy documented earlier. Affiliates can also add the redirect code through the WordPress theme editor or a custom HTML block.
Not every visitor sees the scam. Help TDS checks browser details and location before choosing where to send each visitor. Selected users see a fake update notice followed by Microsoft-branded warnings. Infoblox says visitors who aren't picked are resold to other ad platforms. Those platforms often show fake CAPTCHAs designed to trick people into allowing browser push notifications.
Infoblox measured exposure among its own customers. On one day early in the Pages campaign, up to 4% of its Threat Defense cloud customers were exposed to Help TDS. That figure covers Infoblox customers only. It is not an internet-wide infection rate.
What the fake warning looks like
Infoblox describes it as a sequence. The device of their intended victims first displays a notice that an update is required and that their PC will restart. From there, regardless of what they choose to do, warnings that the machine has been disabled by Microsoft cover the screen. Then the pressure builds: a full-screen claim that Microsoft has disabled the computer, with alarms and a purported security phone number. A voice discourages restarting.
Gridinsoft puts it plainly: these are claims made by the page, not a diagnosis from Windows. The "lock" is a browser page in full-screen mode with scripts that make it hard to close. Your files haven't been encrypted and Windows hasn't been disabled. The page tells you not to restart because restarting would end the trick.
Analysis, based on general industry knowledge: Genuine Windows and Microsoft Defender alerts appear in Windows Security and the notification area. They don't appear inside a browser tab with a toll-free number. If a "Microsoft" warning wants you to pick up the phone, that alone tells you it's fake.
What happens if you call
Infoblox researchers actually called. In mid-June 2026 they reached a man who claimed to be Microsoft Technical Support and promised there would be no charge. He asked whether the PC was personal or for work, walked them through Ctrl+Alt+Delete to clear the "lock," and then told them to download UltraViewer, a free remote-desktop tool. The call ended when the researchers asked why they needed it when Windows Defender was already installed.
Gridinsoft explains the logic: the warning creates the emergency; the caller uses the apparent rescue to move toward real remote access. Infoblox stresses that the goal is more than a one-off payment: "Help TDS delivers tech support scams (TSSs) that direct users to call centers, where social engineering is used to convince them to install remote desktop tools," Infoblox said. "It's not simple credit card fraud: it's remote access, living-off-the-land malware operations. Once in, the threat actor can exploit the victim time and again."
The call centers operate at real scale. The Hacker News reports that in one post dated July 17, 2026, the operator claimed a "small call center in Germany will handle 50-100 calls per day." Infoblox also found Hotejka advertising a coming "forced browser extension installation" offer in September. How that would work is still unclear.
Section summary: The page is the bait. The phone call is where the damage happens. The danger begins when you install a remote-access tool for a stranger.
How to escape a fake Microsoft warning in Windows
If one of these pages takes over your screen:
- Don't call the number. Don't click "Scan," "Repair" or any other button on the page.
- Press Esc to leave full-screen mode, then close the tab or the browser.
- If the page won't close, press Ctrl+Shift+Esc to open Task Manager. Select your browser and click End task.
- When you reopen the browser, don't restore your previous tabs. Restoring them can bring the scam page straight back.
- Turn off notifications from sites you don't recognize in your browser settings. Help TDS sends traffic it doesn't use to pages that push notification prompts.
If the page is gone after you close it, you're fine. Seeing the page doesn't mean the PC was compromised.
If you already called and gave access
Act quickly:
- Disconnect the PC from the internet.
- Uninstall any remote-access tool you were told to install. UltraViewer is the one Infoblox saw, but AnyDesk, TeamViewer and similar tools get abused the same way.
- Run a full scan with Microsoft Defender or your antivirus.
- Change your passwords from a different, clean device, starting with email and banking. Turn on two-factor authentication.
- Call your bank if you gave card details or made a payment. Report the fraud to your local police or cybercrime authority.
Analysis: Once someone has had full remote control, a scan can't prove the PC is clean. For a work machine, or if you have any doubt, the safest option is to back up your personal files and reinstall Windows.
Advice for website owners and IT admins
Help TDS depends on hijacked websites, so site owners and admins are a big part of the defense.
- WordPress administrators: Check installed plugins regularly. Look for code you didn't add in themes and custom HTML blocks. Protect admin accounts with two-factor authentication, and look into any redirects you didn't set up.
- Security teams: A static blocklist won't keep up. A summary of the research on Mallory.ai notes that defenders should prioritize behavioral and DNS-based detection over static domain blocklists, monitor websites for unauthorized plugins or injected content, and restrict unapproved remote-access tools used in support scams.
- Enterprise IT: Allow only approved remote-support tools and block the rest. An attacker who can't get UltraViewer onto the machine has nothing left after the phone call.
- Help desks: Tell staff that your IT department will never ask them to call a number shown in a browser pop-up.
Infoblox reports that it learned to predict the operator's domains before they go live. It says it now spots them about seven days in advance and has caught more than 16,000 that Hotejka later used. Exposure among its cloud customers fell to around 0.5%, and Infoblox blames part of what remains on misconfigured DNS policies. Treat these figures with care. They come from the vendor's own telemetry, and Infoblox sells the detection product it is describing. Infoblox hasn't disclosed how its detection works, so no one can check the results independently.
The bigger picture
Help TDS has lasted almost a decade because each part of it is cheap to replace. Hosting is free. WordPress sites with weak security are easy to find. Fear works on nearly anyone, and the remote-access tools the scammers use are legitimate software. Techlomedia puts it this way: the campaign demonstrates how criminals can combine ordinary web hosting, automated traffic routing, compromised websites, and human-operated call centers into a resilient scam operation.
The defense hasn't changed. Microsoft doesn't put phone numbers in browser warnings, and real support won't ask you to install a remote-access tool because a web page told you to call. If the screen is shouting at you, close it with Task Manager. Then pass these steps on to the family member who is most likely to pick up the phone.