Inside Help TDS: Hotejka and Cloudflare Abuse

The report

Infoblox attributes Help TDS to Hotejka and detects 16,000 malicious Cloudflare Pages before they are used to direct users to tech support scam call centers.

Read the full analysis: Inside Help TDS: Hotejka and Cloudflare Abuse (Infoblox Blog).

Indicators

Phishing

• fosetya[.]shop

Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#21). This page is generated from that record and the report’s own title and summary; nothing is rewritten.