A sprawling tech-support scam operation has quietly built one of the largest throwaway hosting footprints researchers have documented on Cloudflare Pages, cycling through more than 20,000 free subdomains over the past six months to serve fake Microsoft security warnings designed to funnel victims into fraudulent call centers.

A Traffic-Routing Machine Behind the Scenes

The infrastructure, which threat intelligence firm Infoblox calls Help TDS — short for Help Traffic Distribution System — doesn’t send victims straight to a scam page. Instead, it acts as a routing layer, pulling in visitors from hacked legitimate websites, malicious advertising, social media links, and spam campaigns, then deciding in real time where each one should land based on their browser and location.

Selected visitors are shown a fake software update notice, followed by an aggressive, Microsoft-branded alert claiming their computer has been disabled. The page plays a loud alarm and locks the browser so the device appears genuinely unusable, pressuring the victim into calling a listed support number rather than simply closing the tab.

What Happens When You Call

Infoblox’s researchers tested the scam directly in June 2026. The person who answered claimed to represent Microsoft Technical Support, asked whether the computer belonged to an individual or a business, and walked the researchers through removing the fake browser lock — all standard social-engineering groundwork before the real ask.

The operator then instructed them to download UltraViewer, a legitimate remote-desktop tool with no inherent malicious code, but one frequently abused by scammers to gain hands-on access to a victim’s machine. Infoblox’s call ended once researchers pushed back on why additional software was necessary — but for a victim who doesn’t ask that question, installing the tool hands a stranger remote control of their computer, opening the door to data theft, unauthorized financial transactions, or the installation of further malicious software.

Who’s Behind It

Infoblox attributes Help TDS to Hotejka, a Russian-language affiliate program that it links — through overlapping DNS history, shared hosting infrastructure, and access to its affiliate control panel — to ROI777, an operation researchers say has been active since at least April 2017. Rather than running the scam directly, Hotejka appears to function as infrastructure-as-a-service: it supplies the traffic-routing technology and disposable domains, while roughly 20 separate affiliates, including groups tracked as Balada Injector, Detour Dog, and DollyWay, drive victims into the funnel.

Disposable by Design

Since April 2026, the operation has leaned almost entirely on Cloudflare Pages’ free hosting tier, churning out an estimated 300 new domains every day and announcing the fresh batch through dedicated Telegram channels. The sheer disposability is the point: domains get burned, flagged, or taken down, and the operation simply mints new ones from an endless supply of free subdomains rather than maintaining infrastructure that could be tracked and blocked long-term.

Beyond the 20,000 domains tied directly to the core scam, Infoblox identified another 10,000 Cloudflare Pages domains apparently linked to related phishing or decoy activity — pages that display innocuous advertisements to automated scanners while reserving the real scam content for selected human visitors. It’s worth noting these numbers describe infrastructure the attackers created for free, not 20,000 compromised Cloudflare customer accounts.

Built to Dodge Detection

The underlying code supporting the campaign fetches its current list of active routing domains from Telegram on a roughly 30-second refresh cycle, falls back to a secondary server if that fails, and can restrict the scam pages to only appear during the call center’s business hours — a level of operational discipline that suggests a mature, long-running affiliate business rather than an opportunistic one-off campaign.

Infoblox says its own detection models are now identifying related domains roughly seven days before they’re put into active use, and that exposure among its customer base dropped from daily peaks of 4% down to under 0.5% by September — numbers that reflect visibility into Infoblox’s own customer traffic rather than a measurement of the campaign’s total reach.

Reducing Your Exposure

• Train users to treat any browser pop-up claiming a device has been “disabled” by Microsoft as fraudulent — Microsoft does not lock devices through browser alerts.
• Block or restrict access to unfamiliar *.pages.dev subdomains at the network or endpoint level where feasible, given how heavily this campaign relies on that infrastructure.
• Treat any unsolicited instruction to install remote-access software like UltraViewer, AnyDesk, or similar tools as a red flag, even when the caller sounds credible.
• Educate staff and family members, particularly less technical users, that legitimate tech support will never cold-call or demand remote access through a browser warning.

The campaign is a reminder that free, legitimate cloud infrastructure remains an attractive shield for scam operations precisely because it’s disposable, scalable, and comes with the implicit trust of a major platform’s domain — a pattern already seen in abuse of other Cloudflare developer services and malicious WordPress plugin networks feeding similar redirect chains.