Infoblox (Oct 15) ties the long-running Help TDS to Hotejka, a Russian-language affiliate program it assesses is a rebrand of ROI777. Since April 2026 the operation has hosted its TDS and fake Windows-alert pages on disposable pages.dev subdomains, about 300 new ones a day, each resolving for roughly a week; Infoblox counted 20,000+ in six months and predicts them about seven days ahead. Traffic comes from compromised WordPress sites (historically a woocommerce_inputs plugin), malvertising, spam and social media, and call-center staff push victims to install remote desktop tools such as UltraViewer. Hunt ideas: newly seen *.pages.dev lookups followed within minutes by a full-screen browser window and a new remote-access tool install (UltraViewer, AnyDesk, etc.) on endpoints that never used one; WordPress sites with unexpected plugins or custom HTML blocks that fetch redirect URLs.