---
title: Hunt: Help TDS / Hotejka tech-support scams on throwaway Cloudflare Pages domains, ending in UltraViewer installs | ctxsec
url: https://ctxsec.com/items/hunt-help-tds-hotejka-pages-dev
description: ""
status: "hunt idea (researcher-confirmed)"
published: 2026-10-16
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-help-tds-hotejka-pages-dev.md)

hunt idea (researcher-confirmed)

2026-10-16

### Hunt: Help TDS / Hotejka tech-support scams on throwaway Cloudflare Pages domains, ending in UltraViewer installs

Infoblox (Oct 15) ties the long-running Help TDS to Hotejka, a Russian-language affiliate program it assesses is a rebrand of ROI777. Since April 2026 the operation has hosted its TDS and fake Windows-alert pages on disposable `pages.dev` subdomains, about 300 new ones a day, each resolving for roughly a week; Infoblox counted 20,000+ in six months and predicts them about seven days ahead. Traffic comes from compromised WordPress sites (historically a `woocommerce_inputs` plugin), malvertising, spam and social media, and call-center staff push victims to install remote desktop tools such as UltraViewer. Hunt ideas: newly seen `*.pages.dev` lookups followed within minutes by a full-screen browser window and a new remote-access tool install (UltraViewer, AnyDesk, etc.) on endpoints that never used one; WordPress sites with unexpected plugins or custom HTML blocks that fetch redirect URLs.

Sources: [Infoblox Threat Intel](https://www.infoblox.com/blog/threat-intelligence/inside-help-tds-hotejka-cloudflare-pages-and-predictive-detection/) · [The Hacker News](https://thehackernews.com/2026/10/help-tds-linked-to-hotejka-as-20000.html)