Researchers Uncover 20,000 Malicious Cloudflare Pages Domains Used in Tech Support Scams
Infoblox found over 20,000 Cloudflare Pages domains used by Help TDS for Microsoft tech-support scams.
Infoblox says Help TDS, a traffic-distribution system it links with high confidence to the Russian-language Hotejka affiliate program and the older ROI777 operation, has used more than 20,000 malicious Cloudflare Pages domains for technical-support scams. Affiliates send victims from compromised sites, malvertising, spam, and social media; the system fingerprints browsers and location, then shows fake Microsoft lock screens that pressure users to call a support number. In a June 2026 test call, an operator impersonating Microsoft support told researchers to install UltraViewer. The chain also uses a malicious WordPress plugin, woocommerce_inputs, previously tied by GoDaddy to more than 10,000 compromised sites. This is abuse of trusted hosting, not a disclosed Cloudflare vulnerability.