— Ingenious AI security check.
Help TDS is a traffic-distribution network feeding fake ‘Windows Security Alert’ pages. Victims land on a page that locks the browser with exit-prevention scripts, shows a scary warning with a phone number, and the ‘technician’ who answers harvests credentials, payment details, or remote access. Microsoft never operates this way — any number on a browser alert is a scam.
A traffic distribution system: infrastructure that routes victims — often from malvertising or compromised sites — to scam pages. Help TDS specialized in tech-support scam lures.
On October 15, 2026, researchers at Infoblox reported that a long-running scam network called Help TDS — now linked to an affiliate program named Hotejka — is serving fake Microsoft Windows security alerts across more than 20,000 domains on Cloudflare's free hosting. The alerts lock your browser, show a phone number, and the call center on the other end talks victims into installing remote-access software. It is a phishing operation run through the browser: the alert is the lure, the phone call is the trap. Spot one in 30 seconds with the check below. No signup, nothing installed. This page is the network view: how the routing works stage by stage, and how to tell whether your own website has been recruited as one of its feeders.
Help TDS does not only run its own pages — it rides other people's websites. Compromised sites and bought ad slots funnel real visitors into the network, and the funnel is cloaked: the site looks clean to its owner and dirty to the visitors being routed. Tick every sign you have seen on your own site, then score it. The check runs on this page; nothing is sent anywhere.
The network is a routing business. One visitor's journey, and the signal each stage leaves for defenders:
| 1. Entry | Malvertising or a compromised website delivers a real visitor. Signal: referrers you never bought start appearing in your analytics. |
| 2. Profiling | The TDS fingerprints the visitor — device, browser, geography, behaviour — and scores how convincing a target they are. The decision takes milliseconds and is invisible to the victim. |
| 3. Routing | Top-scored visitors go to the fake Windows alert. Everyone else is sent to "verify you are human" pages. Signal: two visitors following the same link see completely different pages. |
| 4. Monetisation | The call centre works the alert victims toward a remote-access install. The leftover traffic is farmed for notification permission and resold as spam reach. The domains are disposable; the kit and the call centre are the business. |
Mechanism as described in the Infoblox disclosure of Help TDS / Hotejka, October 15, 2026 — the same reporting this page's figures come from.
Source: Infoblox threat research on Help TDS / Hotejka, reported October 15, 2026.
This page showed you how to spot the scam. DomainGuard watches for lookalike domains impersonating your brand before customers meet them.
No. Microsoft never displays a phone number in a browser security warning and never asks you to call support from a popup. Any number on a browser alert reaches a scam call center whose job is to talk you into installing remote-access software.
Revoke it now: open your browser Settings, go to Privacy / Site settings / Notifications, find the site and remove it. Scam networks abuse notification permission to push spam and fake warnings straight to your desktop long after you leave the page.
The page runs scripts that force fullscreen and re-trigger the alert when you try to leave — deliberate exit-prevention, not a real system warning. Force-quit the browser (Alt+F4 on Windows, force quit on Mac) and restart without restoring tabs.
Yes — it is a phishing lure delivered through the browser instead of email. The fake alert creates panic, and the “support agent” on the phone harvests your credentials, payment details, or remote access. The same rule applies: never trust an unsolicited security warning that demands immediate action.