Is the Help TDS tech-support scam network still operating after Infoblox exposed it, and where does its infrastructure point now?
Yes. Six days after Infoblox published its investigation of Help TDS on October 15, 2026, the scam’s Telegram channel was still announcing fresh web addresses for its fake “Microsoft” lock screens. The domain that the scam’s partners use to redirect traffic, hotcname[.]help, pointed through October 21 to a server in Frankfurt, Germany, that is not on the researchers’ indicator list, and by the morning of October 22 it had moved to another unlisted address. OctoProbe found that the Frankfurt server showed a decoy web page, and that the same decoy appeared on another domain and on a Cloudflare Pages address the channel later announced. Infoblox traces the business behind it to 2017, when it operated under another name, ROI777.
The Redirect Server Was Somewhere New Within Hours
Some Help TDS partners point their own domains at hotcname[.]help through a DNS alias, handing visitors to the operator’s server. Infoblox wrote that the domain “has resolved to about 20 different IP addresses over the last year, most recently 91.196.33[.]144 (AS20797 SERV.HOST).”
Infoblox’s report went live at 9:00 a.m. EDT on October 15, 2026. At 11:26 a.m. EDT the same day, a public scan on urlscan.io recorded hotcname[.]help at 2.27.45.238, an address that internet registry records assign to U1 Digital Services, under a network named for Frankfurt. The address does not appear in Infoblox’s indicators. When OctoProbe checked through Google’s and Cloudflare’s public DNS at 10:42 p.m. EDT on October 21, the domain still resolved there. By 6:58 a.m. EDT on October 22, it had moved again, to 89.125.43.30, an address on a network (AS218731) that is also missing from Infoblox’s indicators. The answer came from ns1.hotns[.]rest, the operation’s own nameserver.
The public record does not show exactly when the switch happened. No public scan of the domain before October 15 was found, so the move could have come shortly before the report rather than after it. The domain’s registry record, first created on October 18, 2025, was last changed on October 18, 2026, three days after publication, and the registration now runs to October 2027.
A Decoy Page Shared With the Scam’s Throwaway Sites
Without the right referral, the new server shows a landing page for a made-up planning app called “Signal,” headlined “Make room for the work that matters.” It is unrelated to the Signal messaging app.
Public scans captured it on herculex[.]top, a domain registered on September 3, 2026, on October 12, three days before the report. By the night of October 21, Cloudflare was showing visitors to herculex[.]top a “Suspected Phishing” warning page. Urlscan.io holds 153 public scans of pages with the decoy’s title, across 137 addresses, from September 22 to October 21; nearly all are free Cloudflare Pages sites with machine-made names such as lemon-spring-mount.
A scan on October 19 found the decoy on lemon-spring-mount[.]pages[.]dev. At 7:28 p.m. EDT on October 21, the Help TDS Telegram channel @trafficredirect announced that same address as a live redirect. Infoblox says it can “detect new Cloudflare Pages configured by the threat actor about seven days before they’re used in Help TDS.”
Editor’s note: Cloudflare hosts millions of unrelated sites, so sharing it is not evidence of a link. The connection between these addresses is the identical decoy page, and for lemon-spring-mount[.]pages[.]dev, the scam channel’s own announcement.
How a “Microsoft” Pop-Up Becomes a Phone Call
Infoblox says the operators have been “active since at least April 2017 and have been largely unaffected by the cybersecurity world around them.” “It’s not simple credit card fraud: it’s remote access, living-off-the-land malware operations.”
Traffic comes from partners with hacked websites, spam, or parked domains. Their code checks the Telegram channel for the current address, and Infoblox says it shows the lure only during U.S. business hours, “Monday through Friday, from 9am to 6pm EDT.” The victim sees an “update required” screen, then a fake Microsoft warning with a toll-free number.
Infoblox called one of those numbers in mid-June 2026. “The receiver identified himself as Microsoft Technical Support and repeatedly emphasized that there would be no charge for the service.” He walked the caller through removing the lock, then asked them “to open the Start window, navigate to ultraviewer[.]net and download the remote access software.” When the researchers pushed back, “the call was disconnected.”
Thirty Thousand Throwaway Addresses
Since April 2026, the operation has run on free Cloudflare Pages (pages.dev) sites. Infoblox says Hotejka “is responsible for roughly 300 of them using several different domain generation algorithms.” “Each of these domains resolves in DNS for approximately one week.” In all, “we’ve detected ~30,000 domains, only about 16,000 of which were announced on their Telegram channel.”
The channel’s public web preview showed more than 570 new pages.dev addresses posted between 10:48 p.m. EDT on October 20 and 8:29 p.m. EDT on October 21. The channel’s first post is dated November 29, 2023.
Before Hotejka, There Was ROI777
Infoblox assesses that the scheme belongs to one small business. “We assess that Hotejka, a small Russian-language affiliate program, operates the TDS.” Infoblox adds that “Hotejka appears to be a rebrand of ROI777, an entity exposed in 2018 for similar activities.” It says DNS history, the operator’s long use of the same advertising platforms, and its command system “give us a high degree of confidence that ROI777 and Hotejka are one and the same.” That is Infoblox’s assessment; no individual operator has been publicly identified.
2017 to 2018: A Middleman for Hijacked Traffic
In June 2018, Guardicore Labs, now part of Akamai, described Operation Prowli, a campaign that it said “has compromised more than 40,000 machines in multiple areas of the world.” The Prowli attackers used a worm called r2r2 to take over servers and mine the cryptocurrency Monero, and sold visitors from hacked websites to ROI777. “Traffic monetizers, such as roi777, buy traffic from ‘website operators’ such as the Prowli attackers and redirect it to domains on demand.” Guardicore described ROI777 as the middleman for the traffic, not as the miner. Some of that traffic, it wrote, went to sites that “reference tech support scams.”
On October 15, 2026, The Hacker News described Hotejka as “suspected to be a successor to ROI777, an entity that was exposed by Guardicore Labs (now part of Akamai) in June 2018 in connection with a traffic manipulation and cryptocurrency mining campaign codenamed Operation Prowli.”
“In its early days, the operator used roi777[.]com as the C2 infrastructure.” GoDaddy’s indicator list for Help TDS includes roi777[.]com among its historical command domains, and The Hacker News reported that GoDaddy found the domain “was one of the historical C2 domains used between 2018 and 2020 to fetch the redirect domains.” Infoblox links the ROI777-era system, which GoDaddy named Disposable TDS, to today’s: “Disposable TDS, operated by ROI777, is the precursor of Help TDS.”
What the 2018 ROI777 Leak Purportedly Shows
On March 13, 2018, an anonymous Pastebin user posted what were presented as database tables taken from ROI777’s servers. Three of them open with the same line: “roi777.com is involved in cyber crime activities. Here is some informations about those crooks.” Guardicore later wrote that “another anonymous researcher hacked the roi777 website and uploaded the raw data to Pastebin,” and that the dump listed “users, bitcoin wallet addresses, telegram IDs etc.” OctoProbe reviewed five of the pastes, all still online; they are unauthenticated.
A table labeled telegram_db (Pastebin) lists eleven Telegram accounts by chat ID, display name, and username. Two are brand accounts: @roi777Ru, under the display name “Tip Top,” and @roi777eng, “Roi777Eng Traffic Monetization.” The other nine carry personal-looking names or nicknames and are not named here. The “Tip Top” label echoes an Infoblox finding: “In 2025, Hotejka advertised using the moniker TipTop, the originally reported ROI777 operator’s Telegram handle.”
A second table (Pastebin) purports to be the user list of a Keitaro server, commercial traffic-routing software; Infoblox says Help TDS was “originally implemented on a Keitaro server.” It holds eleven logins, one administrator and ten users, each with a password hash and rules setting which campaigns the user could see.
The largest paste, a table labeled keitaro_campaigns (Pastebin), is the affiliate side of the purported database: the campaign table that tied each traffic supplier to the visitors it sent and the pages those visitors were shown. It holds 333 campaign records last edited between March 7, 2017, and March 8, 2018. Most of them, 295, are labeled with email addresses, apparently one per supplier. Other names, in Russian, include “Doorways” and “Chrome installs.” Five campaigns carry call-center phone numbers for the United States and Canada, France, Belgium, the United Kingdom, and Australia, and four of those are set to an action type called “tech_support.” All five were last edited between February 19 and 23, 2018, about three weeks before the leak. One login in the Keitaro user table had report access to only six campaigns: those five and a sixth in the same series that sends visitors to a dating site.
| Columns | What they record | In the 333 rows |
|---|---|---|
| id, alias, name | Campaign number, short code, and label | 295 labels contain email addresses |
| type, position | How the campaign’s routes are ordered | “position” 328; “weight” 5 |
| uniqueness_method, cookies_ttl | How repeat visitors are counted | Cookie, 24 hours, in all 333 |
| action_type, action_payload | What a visitor is sent | “status404” 300; “http” 26; “tech_support” 4; “campaign” 2; “sub_id” 1. Payload filled in 34 |
| action_for_bots, bot_redirect_url, bot_text | What bots and scanners see instead, or cloaking | “do_nothing” 273; “404” 51; “show_text” 6; “redirect” 3. Bot redirect address in 9; bot text in 1 |
| state, updated_at | Status and last edit | Active 327; deleted 6. Last edit blank in 23 |
| cost_type, cost_value, cost_currency | Pricing model | “CPV” in all 333; cost_value 0.0000 in all 333; USD in 47, blank in 286 |
| group_id | Campaign group | Set in 302 rows, with 293 distinct values |
| bind_visitors | Visitor-binding setting | 0 in all 333 |
Counts by OctoProbe from the pasted rows. The table records no payout amounts.
Three of the four “tech_support” campaigns, for the United States and Canada, France, and the United Kingdom, send bots and scanners to a different site than the one human visitors receive.
Another paste (Pastebin) lists four administrator accounts, with names, email addresses, and password hashes, for a PrestaShop online-store installation dated 2016; one is plainly a test account. A fifth (Pastebin) is the server’s MySQL account list: forty database logins, including root and administrator accounts, with hashes. Many of the account names refer to unrelated-looking websites, which suggests the server hosted other sites as well.
One campaign record sends leftover visitors to a dating site with the tracking code u=h2xkd0x. The same code appears in a February 25, 2020, redirect chain on urlscan.io that Infoblox cites, writing the ROI777 affiliate ID as h2xkd0. Infoblox says that ID and one other “were used over several years and tied together multiple versions of the C2.”
The 2018 records show country-targeted tech-support campaigns with call-center numbers run on Keitaro, the business Infoblox describes in 2026. That is consistent with Infoblox’s assessment but does not by itself prove the same people run both.
Editor’s note: The leaked records are unauthenticated and are described here only in general terms. Password hashes, phone numbers, email addresses, and the names of individuals are withheld, and nothing in the pastes shows who runs Hotejka today.
The Account Called Nik
One of the four PrestaShop administrator accounts in the leak (Pastebin) has the first name “tipatop,” the last name “Nik,” and the email address comp***@gmail.com. Its password was last set on August 1, 2016.
A record in data from the 2020 Tokopedia breach ties the same email address to the name Nikita and a birth year of 1989. Tokopedia, an Indonesian online store, suffered a breach that exposed “names, genders, birth dates and passwords stored as SHA2-384 hashes,” according to the breach-notification service Have I Been Pwned.
The account name “tipatop” is close to “Tip Top,” the display name on the @roi777Ru account in the leaked Telegram table, and to “TipTop,” the moniker Infoblox says Hotejka used in 2025. The match rests on leaked and breached data and a resemblance between names. It does not show that the account holder runs or ran ROI777 or Hotejka.
A New Name on the Same Server
Infoblox says ROI777 was reported repeatedly in 2018 and 2019, including in the Akamai-hosted Prowli report, and that its data was dumped online. “We suspect these events led to the rebranding from ROI777 to Hotejka.”
The domain hotejka[.]com was registered in November 2019, and from early 2020 it served as the reverse-DNS name, or PTR record, for 162.244.35.33. “This is the same IP address that hosted roi777[.]com until mid-March 2022, alongside many tech-support-scam-related domains.” As Infoblox notes, “whoever controlled 162.244.35[.]33 and roi777[.]com set the record for hotejka[.]com as well.” The 2020 urlscan.io chain shows the command domain of that period, roi-traffic[.]icu, answering from the same address.
Hotejka set up Telegram channels in late 2019, advertised openly from September 2020, and posted login pages by November 2021, according to Infoblox, while ROI777’s login pages “seem to disappear after January 2022.” An Internet Archive Wayback Machine capture of roi777[.]com/login from March 15, 2017, shows the heading “Traffic Monetization.” Infoblox adds: “We suspect that in the first few years, Hotejka users logged in via the ROI777 portal.”
In 2025 the operator advertised $20 per call on the forum zenno[.]club, according to Infoblox, and “In May 2026, they offered $100 for the same traffic and further asked for web shells or admin panels.” Infoblox estimates that two European advertising platforms “have paid them at least a few million dollars (USD).”
The offers continue on the Telegram channel that Infoblox identifies as Hotejka’s. On April 6, 2026, the channel, titled “HOT,” announced a new country for its “Tech Support Browser Locker” offer: Belgium, at $17 per call, with a minimum of five calls a day, PC traffic only, and Saturday and Sunday listed as days off, according to the post, which is in Russian. It directs partners to @hotejka_support and to a registration page at hotejka[.]ink. The leaked 2018 campaign table also included a Belgium call-center campaign set to “tech_support.” The parallel is consistent with Infoblox’s assessment but is not proof that the same people run both.
Infoblox lists 62.113.117.248, an address at the host VDSina, as a Hotejka indicator; OctoProbe found it still answers for ns1.hotns[.]rest, the operation’s current nameserver, on October 21.
The Partners Feeding It
Infoblox counts about twenty affiliates in 2026 and names Balada Injector, Detour Dog, and DollyWay, “all of whom have been Hotejka affiliates for many years.” GoDaddy wrote that “Help TDS has positioned itself as the dominant monetization platform for numerous malware operations.” Traffic also flows out: The Hacker News reported that Help TDS “has routinely handed off traffic directly to VexTrio Viper,” another criminal ad network.
Burner Toll-Free Numbers
Infoblox observed three call-center numbers in Help TDS lures. Monthly toll-free registry snapshots compiled by Resporgs.com show each changing hands repeatedly among “RespOrgs,” the companies that manage routing. All three passed through the same one, Mayfair Communication, between June 2025 and August 2026. The number Infoblox dialed in June (855-6**-**18) has shown as disconnected since August 2026; 855-3**-**64 was working in the October snapshot, and 844-9**-**66 was in transit. Nothing in the records suggests the providers knew how the numbers were used.
Editor’s note: Toll-free numbers are reassigned, and earlier and later holders are not connected to the scam, so the numbers are partly masked here.
The Network Map
OctoProbe mapped the network with its identifier-graph method. The graph held 701 nodes as of October 22, 2026.
Frequently Asked Questions
What is Help TDS?
A traffic distribution system that sorts web visitors from hacked sites, spam, and parked domains and sends qualifying U.S. users to fake Microsoft lock screens with toll-free numbers for call centers. Infoblox says it has been active since at least April 2017.
Who runs Help TDS?
Infoblox assesses that Hotejka, a small Russian-language affiliate program, operates it. No individual has been publicly identified.
Is Hotejka the same as ROI777?
Infoblox assesses that it is. It says historical DNS records, long use of the same advertising platforms, and consistent command-and-control mechanisms give it a high degree of confidence that the two are one and the same. Its clearest example is 162.244.35.33, an address that hosted roi777[.]com until mid-March 2022 and, from early 2020, carried hotejka[.]com as its reverse-DNS name. ROI777 was named in Guardicore Labs’ June 2018 report on Operation Prowli as a buyer of hijacked web traffic.
What was in the 2018 ROI777 leak?
On March 13, 2018, an anonymous Pastebin user posted tables purportedly taken from ROI777 servers: eleven Telegram accounts, eleven logins for a Keitaro traffic-routing server, 333 campaign records, most labeled with email addresses, and two database account lists. Five campaigns carried call-center numbers for five countries, and four were set to a “tech_support” action. The records have not been authenticated.
Is Help TDS still active after the Infoblox report?
Yes. On October 21, 2026, its Telegram channel was still announcing new Cloudflare Pages addresses, and its redirect domain, hotcname[.]help, resolved to a Frankfurt server that was not on Infoblox’s October 15 indicator list.
What happens if you call the number on the pop-up?
In Infoblox’s test call, a man claiming to be Microsoft Technical Support removed the lock and told the caller to download the UltraViewer remote-access tool, which would give him complete access to the computer.
