Hotejka scam network uses free hosting to target users

Infoblox has identified a long-running cybercrime operation that uses free website-hosting services to run tech-support scams. It linked the activity to a group known as Hotejka.

The operation has been active since at least 2017 and has used services including Cloudflare Pages to create hundreds of scam pages each day, researchers said. Over the past six months, they identified more than 20,000 related domains, along with another 10,000 pages apparently used for phishing or as decoys.

At the centre of the activity is a traffic distribution system known as Help TDS, which directs users to different destinations based on signals such as location or device. The findings say the system channels traffic from compromised websites, malicious online adverts, social media and spam to fraudulent tech-support call centres.

The scams typically use fake Microsoft security alerts, loud warning sounds and browser locks to alarm users into making contact. Once a victim calls, staff at the fake support centres try to persuade them to install remote desktop software, giving the scammers control of the computer.

Researchers traced one such chain to a call centre and spoke directly to an operator. During the interaction, the caller was told to download UltraViewer, a free remote desktop tool, after being helped to remove a browser lock.

The research argues that the fraud goes beyond attempts to obtain card details or sell unnecessary software. By securing remote access to a victim's device, the operators can retain access after the initial call and potentially use that foothold for further exploitation.

Infoblox describes Hotejka as a Russian-language affiliate programme that it believes operates Help TDS and may be a rebrand of an earlier operation known as ROI777. Affiliates were reportedly offered up to USD $100 for driving traffic to the fraudulent sites, underlining the role of a broader partner network in sustaining the scam.

Detection efforts

Alongside the attribution findings, Infoblox said it has developed a method to identify malicious domains about seven days before they are used. It said this allowed it to detect more than 16,000 campaign domains before activation.

Exposure among its cloud customers dropped sharply after detection improved, Infoblox said. Daily exposure reached as high as 4% on one day, but later fell to less than 0.5% in September, according to figures it released.

The findings also point to a wider challenge for cyber defenders as criminal groups increasingly use mainstream online infrastructure rather than bespoke malicious hosting. By building scam pages on legitimate platforms, operators can blend in with ordinary internet traffic and make rapid changes to their campaigns.

Free hosting tools can also lower operating costs and shorten setup times for criminal networks. In this case, the use of a well-known platform enabled the group to create scam pages at scale while maintaining the flexibility to rotate domains and landing pages quickly.

That scale may help explain why the operation has persisted for so long. The report describes Help TDS as unusual for its longevity, having survived in multiple forms for years despite scrutiny from security researchers.

For businesses, the issue is not limited to individual consumers being tricked into calling fake support numbers. Employees who access compromised sites or malicious adverts on work devices could be exposed to the same social-engineering techniques, creating a route into corporate systems if remote-access software is installed.

The use of compromised websites in the traffic chain also broadens the risk. A user may initially visit a legitimate site before being redirected through the distribution system to a fraudulent support page, making the scam harder to spot at the outset.

Security researchers have long tracked traffic distribution systems as a common layer in online criminal operations because they allow actors to manage and filter visitors before deciding what content to serve. In the Hotejka case, that structure appears to have helped the operators target victims efficiently while insulating other parts of the scheme from direct exposure.

Renée Burton, Vice President of Infoblox Threat Intel at Infoblox, said: "Often people associate tech-support scams with unnecessary antivirus services and nuisance credit card theft. Today's scams are complex social-engineering attacks that give threat actors unfettered access to devices and the ability to continue exploiting the victim well past the initial phone call."