Hackers Abuse 20,000 Cloudflare Pages Domains to Push Fake Microsoft Security Alerts

Hackers have abused more than 20,000 Cloudflare Pages domains over six months to spread fake Microsoft security alerts and steer users toward scam call centers.

The campaign uses Help Traffic Distribution System, or Help TDS, to route visitors from compromised websites, malicious ads, social media, and spam into tech support scams.

The pages claim that Microsoft has disabled the computer, play loud alarms, and display a support number. A browser lock makes the device appear unusable, pushing victims to call someone posing as a Microsoft technician. The goal is remote access, not simply a payment for fake repairs.

Infoblox researchers identified the malware-linked operation and assessed that Hotejka, a Russian-language affiliate program, runs Help TDS.

Their October 15 research report links Hotejka to ROI777 through historical DNS records, shared infrastructure, affiliate identifiers, and access to its affiliate panel. The operation dates to at least April 2017.

Hackers Abuse 20,000 Cloudflare Pages Domains

Help TDS checks browser details and location before choosing where to send each visitor. Selected users see a fake update notice followed by Microsoft-branded warnings.

Earlier reporting on Help TDS website redirects described how malicious PHP templates and WordPress plugins turn legitimate websites into entry points for similar scams.

Infoblox tested the call center in June 2026. An operator claimed to represent Microsoft Technical Support, asked whether the computer belonged to a person or business, and helped remove the browser lock.

He then instructed the researchers to download UltraViewer, a legitimate remote desktop tool that attackers can misuse for system access.

The call ended after researchers questioned why additional software was needed. This distinction matters: UltraViewer is not presented as a custom malware payload.

The scam relies on convincing users to install remote access software themselves, creating access that could support data theft or further attacks.

Disposable Cloudflare Pages Infrastructure

Since April 2026, the group has hosted its TDS and scam pages on disposable Cloudflare Pages sites. It announces roughly 300 fresh domains daily through Telegram.

Previous coverage of Cloudflare developer domain abuse shows how criminals also use these services for phishing redirects and fake verification pages.

Infoblox detected another 10,000 Pages domains apparently tied to phishing or decoy activity, beyond the 20,000 associated with the core operation.

Some pages show harmless-looking advertisements during direct scans, helping hide their role. These figures describe attacker-created infrastructure, not 20,000 compromised Cloudflare customer accounts.

The affiliate code retrieves current routing domains from Telegram, uses a fallback server, and refreshes cached results every 30 seconds.

It can limit scam displays to call center working hours. GoDaddy previously documented the malicious WordPress plugin infrastructure supporting these redirects.

Infoblox identified about 20 affiliates, including Balada Injector, Detour Dog, and DollyWay. Earlier research into DollyWay WordPress malware infections explains how compromised sites feed traffic into scam networks, linking website infections to the visitors who eventually encounter fake alerts.

Infoblox says its detection models identify related domains about seven days before use. Exposure among its cloud customers fell from daily peaks of 4% to below 0.5% in September. These are vendor-specific exposure figures, not confirmed infection rates or measures of the entire campaign.

Indicators of compromise (IoCs):-

Type	Indicators	Reported role
Cloudflare Pages	arrow-berry-gem.pages[.]dev ashen-drift-stone.pages[.]dev solar-cloud-branch.pages[.]dev	Help TDS domains
Additional Pages	sun-sky-calm[.]pages[.]dev linen-thorn-wild[.]pages[.]dev	Decoy; reused domain
Operator infrastructure	hotejka[.]ink hotns[.]rest hotcname[.]help pinkfels[.]shop	Affiliate portal, nameserver, redirects, fallback
Affiliate domains	zylvantrexor[.]lol fosetya[.]shop goalods[.]lol trixsolvesxa[.]shop	Affiliate infrastructure
IP addresses	62.113.117[.]248 91.196.33[.]144	Listed hosting infrastructure
VPN endpoints	usa.on1xvpn[.]com usa.on1xvpn[.]ru	Shared hosting connection
Telegram channels	trafficredirect hotejka_hot	Domain announcements; operator channel
Telegram accounts	hotejka_support hot2_support hotejka hotejka_admin	Support and operator accounts
Telegram bot	freeassistant_bot	Affiliate advertising
Phone numbers	+1 855-616-3518 +1 855-361-0064 +1 844-959-1966	Observed scam numbers
Historical infrastructure	roi777[.]com roi777[.]online roi-traffic[.]icu hotejka[.]com 162.244.35[.]33	Attribution evidence
Other observed domains	varbani[.]com lib1[.]biz	Historical redirect; parked-domain entry
Shared Cloudflare nameservers	ligia.ns.cloudflare[.]com coleman.ns.cloudflare[.]com	Observed configuration, not standalone malicious indicators
Legitimate software site	ultraviewer[.]net	Download destination requested by scammer
Affiliate identifier	u=h2xkd0	Historical traffic attribution

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.