DNS detection spots Help TDS scam domains a week early

Infoblox says its DNS detection now identifies domains tied to Help TDS about seven days before the scam operation uses them. DNS, or the Domain Name System, is the lookup system that connects website names to internet destinations. The company attributes Help TDS to Hotejka, a small Russian-language affiliate program that it assesses is a rebrand of ROI777, an operation active since at least April 2017.

Help TDS is a traffic distribution system, or TDS, that decides where website visitors should be sent. Affiliates obtain specially constructed links from Hotejka and feed them traffic from compromised websites, malicious advertising, social media and spam. The system uses browser fingerprinting, which evaluates characteristics of a visitor's browser and device, together with location data. Selected visitors see a false update notice followed by full-screen warnings claiming Microsoft has disabled the computer. Loud alarms, a recorded voice and a difficult-to-close browser page direct the victim to a supposed support number.

Infoblox called one of those numbers from a research machine in June 2026. The operator claimed to represent Microsoft Technical Support, asked whether the device was personal or used for work, and repeatedly said there would be no charge. After explaining how to exit the obstructive page, the operator instructed the researcher to visit ultraviewer[.]net and install UltraViewer. This is remote desktop software, a tool that lets another person control a computer over the internet. The call ended after the researcher questioned why extra software was needed when Windows Defender was already installed. Infoblox says this is more than a payment-card ruse because remote access could support repeated intrusion, information theft and extortion.

The attribution to Hotejka draws on historical DNS data, command-and-control infrastructure and long-running affiliate identifiers. Command and control, abbreviated C2, is the infrastructure used to distribute instructions or current destinations. ROI777 originally used roi777[.]com for C2 and operated a Keitaro-based routing system on King Servers. In 2018, researchers documented its malicious redirects, and data taken from ROI777 servers showed Telegram identities, campaign information and traffic sent to another European affiliate platform. GoDaddy called the earlier operation Disposable TDS because it relied on domains from the now-defunct Freenom registrar.

Infoblox also connected the operations through 162.244.35[.]33. The address hosted roi777[.]com until mid-March 2022, while hotejka[.]com, registered in November 2019, appeared as its PTR record from early 2020. A PTR record is a reverse DNS entry that associates an internet address with a name and is set by whoever controls that address. Hotejka's channels began appearing in late 2019, its open-web advertising was visible by September 2020, and ROI777 login pages disappeared after January 2022. Infoblox therefore assesses with high confidence that the same operator runs both identities.

Hotejka buys visits from roughly 20 identified affiliates in 2026, including Balada Injector, Detour Dog and DollyWay. Some compromise WordPress sites, while others use spam, advertising or social platforms. One affiliate used a Telegram bot called Your Free AI Assistant in June 2026 to deliver advertisements leading into Help TDS. Unwanted visitors can also be resold to other affiliate systems, where they may encounter further scams or fake CAPTCHA tests designed to obtain browser-notification permission. Hotejka advertisements offered $20 per call in 2025 and $100 for similar traffic in May 2026, while seeking victims in countries including the United States, Canada, France, Sweden, Japan and Australia. In July 2026, Infoblox found Hotejka was the fourth most profitable affiliate on one downstream platform. Based on eight years of DNS volumes, affiliate identifiers and commonly cited advertising payouts, Infoblox suspects two European programs paid the operation at least several million US dollars, although that remains an estimate.

Since April 2026, the operation has used free, disposable Cloudflare Pages sites under pages[.]dev. More than 125,000 new pages[.]dev subdomains typically appear each day, while Hotejka's Telegram C2 channel announces nearly 300 daily and updates its active set every five minutes. Each domain resolves in DNS for about a week. Infoblox says the actor has used 12 domain generation algorithms, meaning automated rules for creating domain names, during six months. It detected about 30,000 likely related domains in total, including roughly 16,000 later announced for Help TDS and about 10,000 others apparently used as decoys or for additional phishing activity.

The detector was implemented in July. Since then, Infoblox says it identified more than 10,000 likely Help TDS domains before their Telegram announcement, with both an average and median lead time of seven days. Exposure among its cloud customers had reached as much as 4% on a single day when the operation first moved to Cloudflare Pages. In September, that figure was around 0.5%, although some remaining exposure was attributed to incorrectly configured response policy zones. These percentages describe Infoblox customers, not internet users generally.

The operators try to frustrate direct inspection by displaying decoy pages. One domain showed an unrelated advertisement before later appearing in the C2 channel, while another decoy impersonated Ledger in an advertisement for a fake financial application. Domains have also been reused. linen-thorn-wild[.]pages[.]dev first appeared in DNS on August 4, was detected on August 6 and announced ten days later. It returned with different Cloudflare nameservers on September 10 and was announced again on September 20. Infoblox could not determine whether such repetitions are accidental naming collisions or an attempt to establish domains before malicious use.

A separate route uses a CNAME, a DNS record that maps one hostname to another. Affiliate domain fosetya[.]shop pointed to Hotejka-controlled hotcname[.]help. On September 21, parked domain lib1[.]biz passed a visit through several advertising systems before it reached the scam, with one platform selling the click to Hotejka for $0.065. hotcname[.]help has used about 20 internet addresses over a year, most recently 91.196.33[.]144. That address also hosted usa.on1xvpn[.]com and usa.on1xvpn[.]ru, apparently endpoints for the Russian-language On1x VPN service. Infoblox says any broader relationship between that VPN and Hotejka remains unclear.

The affiliate panel lets website operators insert malicious code through a WordPress theme editor, plugin or custom HTML block. That code retrieves the latest C2 domain from Telegram or pinkfels[.]shop, refreshes its cached result every 30 seconds, adds the affiliate's identifier and displays either a fake CAPTCHA or update lure.