Inside Help TDS: Hotejka, Cloudflare Pages and Predictive Detection

This report attributes the long-running Help TDS tech-support-scam network to a Russian-language affiliate program called Hotejka (a rebrand of ROI777), documents its operational ecosystem (affiliates, call centers, C2 updates via Telegram, and abuse of free Cloudflare Pages with domain-generation algorithms), describes the scam flow (browser locks, alarm lures, and social-engineered installation of remote-access software like UltraViewer), quantifies scale and exposure (tens of thousands of pages detected, up to 4% exposure reduced to ~0.5% through predictive detection), and publishes indicators (Telegram channels, domains, IPs, affiliate domains, Cloudflare Pages examples, and call-center phone numbers) to support detection and mitigation.