Infoblox links 20,000 Cloudflare Pages domains to Help TDS; a browser scare becomes a remote-access lure

The important transition is from a warning to access

Infoblox’s 15 October 2026 report says it detected more than 20,000 Cloudflare Pages domains over six months associated with Help TDS. It assesses that the Russian-language affiliate programme Hotejka operates the network. That is vendor attribution, not a finding about a state sponsor. Infoblox report.

The article’s practical question is what a frightened browser user is induced to do next. A page that appears to lock a computer can be a route to a conversation, and that conversation can become a request for remote access. Security controls need to cover that human transition as well as the destination URL.

Infoblox says its researchers called a number in the lure and were asked to install UltraViewer. The documented test is an installation request in that interaction; it does not establish how many victims granted access. Traffic can arrive through compromised sites, advertising, social posts and spam. Researcher account.

Feature image: Scam example from Infoblox’s 15 October report. The displayed warning and contact number are fraudulent; do not use them. Credit: Infoblox Threat Intel.

Read the unit before the headline number

All campaign measurements below are Infoblox claims, with different units and windows.

Reported measure	What it counts	What it does not count
More than 20,000 domains / six months	Domains detected in the vendor’s tracking	20,000 infected devices
Up to 4% in one day	Exposure within its cloud customer population	4% of all internet users
Around seven days	Reported advance detection before use	A guarantee for every future domain

These are useful measurements with limited denominators. Infoblox does not publish a global victim total or an independently reproducible accuracy dataset in the reviewed report. Measurement context.

Assessment: domain churn makes a list of yesterday’s addresses an incomplete control. Conversely, belonging to a heavily used hosting platform is not enough to identify a malicious site. A defensible block needs evidence attached to the specific destination, with a way to review false positives and legitimate business impact.

The help desk needs a trusted route

Microsoft says genuine error and warning messages do not include phone numbers, and it does not make unsolicited calls offering technical support. It warns that scammers can use full-screen pages and persistent pop-ups to make a browser appear locked. Microsoft guidance.

For an organisation, publish a help-desk contact that staff can find independently of the device displaying the warning. A trusted contact route is much less useful if it is buried in a document that the frightened user cannot open. Include contractors, reception staff and shared-device users in the explanation.

The remote-access approval process should ask who initiated the session, how the support person was verified, which device is involved and what access is being requested. A familiar tool name does not answer those questions. A legitimate remote-desktop product can be misused; its presence alone is not proof of malicious activity.

UK reporting and evidence limits

The NCSC reporting page accepts suspicious website reports and advises against clicking further links or entering personal information. Its page directs fraud or cyber-crime victims in England, Wales and Northern Ireland to Report Fraud, and those in Scotland to Police Scotland. A website report is not itself a crime report.

Microsoft’s recovery advice includes removing applications the scammer requested, scanning the device, changing passwords and considering a reset after remote access was granted. On an employer-managed device, involve the security team so containment and evidence preservation are coordinated. Microsoft recovery advice.

What would change this assessment? Confirmed incident accounts, independently checked operator evidence and measurements that disclose their population, outcome and false-positive method. The immediate control remains simple: verify the support relationship before granting access.