Search — “Hotejka”

Infoblox and GoDaddy research links the long-running Help TDS traffic distribution system to the Russian-language affiliate program Hotejka, assessed as a rebrand of ROI777. The TDS is implemented on Keitaro and fed by compromised WordPress sites (malicious plugin woocommerce_inputs) and other affiliates, routing victims to tech support scams that push remote desktop tools like Ultraviewer. Since April 2026 scam pages run on disposable *.pages.dev Cloudflare Pages sites, with over 20,000 detected; hunters should look for WordPress plugin abuse, redirects into Keitaro-style TDS paths, and remote access tool installs following scareware pages.