# Fake Microsoft Alerts Spread Through 20,000 Cloudflare Pages Domains

- URL: https://usa-24.com/fake-microsoft-security-alert-scam/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-17T13:37:04.647Z
- Updated: 2026-10-17T13:37:04.653Z
- Topics: Tech Support Scams, Microsoft, Cloudflare, Phishing, Remote Access Scams, Help TDS

> Infoblox traced the Help TDS tech-support network to more than 20,000 Cloudflare Pages domains that push fake Microsoft alerts and route victims to scam call centers.

## Key takeaways

- More than 20,000 Cloudflare Pages domains have been abused over about six months to push fake Microsoft security alerts and route victims to scam call centers.
- The end goal is remote access, with victims pushed to install tools such as UltraViewer rather than pay for a fake repair.
- Infoblox assessed that Hotejka, a Russian-language affiliate program, runs Help TDS, a link the researchers tie to ROI777.
- The operation moved its scam pages to Cloudflare's free hosting in April 2026, and one analysis says the trusted pages.dev domain helps them slip past enterprise URL filters.
- Do not call a number shown in a full-screen warning, and never install remote-access software at a stranger's request.

More than 20,000 Cloudflare Pages domains have been pushing fake Microsoft security alerts to people in the United States and other countries, steering them toward fraudulent call centers. Researchers at Infoblox traced the activity to a long-running tech-support scam network called Help TDS, and their report went public on October 15, 2026. [The Hacker News](https://thehackernews.com/2026/10/help-tds-linked-to-hotejka-as-20000.html) and other outlets followed the story on October 15 and 16.

The lure is theatrical. Selected visitors first see a fake update notice, then Microsoft-branded warnings that claim the computer has been disabled. Loud alarms play, a browser lock makes the screen hard to leave, and a support number fills the display. The victim is pushed to call someone posing as a Microsoft technician.

The payoff is control of the machine, not a fee for a fake repair. [Cyber Security News](https://cybersecuritynews.com/cloudflare-pages-domains/) reports that the goal is remote access. [Techlomedia](https://techlomedia.in/2026/10/hackers-use-20000-cloudflare-pages-domains-to-run-a-large-scale-microsoft-support-scam-127273/amp/) notes that the operators rarely rely on a custom malware payload. Instead, they try to persuade victims to install legitimate remote-access software and hand over control. According to [GBHackers](https://gbhackers.com/20000-malicious-cloudflare-pages/), Infoblox describes a June 2026 test call in which the operator told its researchers to clear the browser lock and download UltraViewer.

## How Help TDS picks its targets

Help TDS is a traffic distribution system, a router that decides where each visitor ends up. It receives people from compromised websites, malicious ads, social media posts and spam. Before it chooses a destination, it checks browser details and location, so two people clicking the same link may land in different places.

That routing layer explains why the network has lasted so long. Infoblox's research dates the operation to at least 2017, and earlier activity leaned on compromised sites. Malicious PHP templates and WordPress plugins turned legitimate websites into entry points for similar scams.

The key figures from the reporting include the following:

- More than 20,000 Cloudflare Pages domains abused over about six months
- Approximately 10,000 additional pages apparently tied to phishing or decoy activity, though their purpose is uncertain, according to [Arabian Post](https://thearabianpost.com/researchers-trace-20000-scam-domains-to-help-tds/)
- About 300 new domains announced each day through Telegram, per GBHackers
- An Infoblox report date of October 15, 2026

## Who runs Help TDS and how sure researchers are

Infoblox assessed that Hotejka, a Russian-language affiliate program, runs Help TDS. The October 15 report links Hotejka to ROI777 through historical DNS records, shared infrastructure, affiliate identifiers and access to an affiliate panel. Those findings are the researchers' assessment, not a law-enforcement determination, and the sources reviewed do not describe any official action.

Affiliate programs let many operators feed traffic into shared tooling. That structure explains how one traffic engine can sit behind lures that look different on the surface. It also makes takedowns harder, because removing one front end rarely stops the flow of visitors.

## Why Cloudflare Pages became the scam's new home

The tactic is old, but the hosting is new. According to [Arabian Post](https://thearabianpost.com/researchers-trace-20000-scam-domains-to-help-tds/), the operation moved its scam pages to Cloudflare's free website hosting service in April 2026, and researchers spent the following six months identifying the malicious subdomains. Free hosting makes it cheap to launch pages, and a subdomain on a well-known platform carries a reputation that a brand-new domain does not.

One vendor-side analysis from [Tech Jack Solutions](https://techjacksolutions.com/scc-vendor-rollup/cloudflare-abused-infrastructure-vulnerability-rollup-2026-10-16/) argues that the weakness is structural rather than a flaw in Cloudflare itself. Reputation-based URL filtering struggles with high-volume shared hosting platforms, where one trusted domain hosts many legitimate sites alongside a few bad ones. The same analysis says the trusted pages.dev reputation helps the scheme slip past enterprise URL filtering from Cisco Umbrella, Forcepoint and Zscaler. That is one report's claim, and the reporting reviewed did not include independent testing of it.

Cloudflare's response was not confirmed in the coverage reviewed. Malicious ads have also been a delivery route for other threats, as in USA 24's [report on Candiru spyware reaching Al Jazeera devices through ordinary online ads](https://usa-24.com/candiru-spyware-al-jazeera-ads/).

## How to spot a fake Microsoft security alert

Most of these pages share a recognizable pattern, and the advice below applies whether the alert arrives through a search result, an ad or a link in a social post.

- Treat any full-screen warning that says Windows is locked, disabled or infected as a scam until you confirm it through your own tools.
- Do not call the phone number on the screen. Real security problems do not require you to phone a number shown on a web page.
- Do not install UltraViewer, AnyDesk or any other remote-access tool because a pop-up or a caller asked you to.
- Close the browser through Task Manager (press Ctrl+Shift+Esc on Windows) or force-quit it, rather than following on-screen instructions.
- Review installed programs and uninstall any remote-access software you do not recognize.

## What to do if you already called

If you called and gave someone access, act fast. Disconnect the computer from the internet so the session cannot continue, then change passwords from a different, clean device, starting with email and banking accounts. Contact your bank or card issuer if you shared account details or sent money. Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov. A professional review or rebuild may be the safest path, because you cannot be sure what the caller installed or copied.

## What enterprises should check now

Security teams should search DNS and proxy logs for pages.dev subdomains tied to Help TDS, and they should review whether URL-filtering policies trust shared hosting platforms by default. A scam page carrying a trusted domain can look harmless to a filter that scores reputation alone. Remote-support software is also a target, as USA 24's [coverage of a BeyondTrust zero-day](https://usa-24.com/beyondtrust-zero-day-remote-support-attack/) shows, so limit who can install remote tools on managed endpoints.

## What comes next for Help TDS

Three threads will matter in the coming weeks. The first is whether Cloudflare removes the flagged subdomains and explains its response, which the reporting reviewed has not confirmed. The second is whether Microsoft comments or moves to take down the lures, and no comment was found in the sources reviewed. The third is whether investigators act on the Hotejka and ROI777 attribution, which currently rests on the researchers' analysis. Victim counts and financial losses are missing from the public reporting, so the true cost of the scheme remains an open question.

## Frequently asked questions

### How can I tell if a Microsoft security alert is fake?

The Help TDS pages follow a clear pattern: a full-screen warning claims Windows is locked or disabled, alarms play, and a phone number appears. Close the browser through Task Manager rather than following the on-screen steps. Check your real security status through apps you open yourself.

### Should I call the Microsoft support number shown in a pop-up?

No. The reporting describes these numbers as connecting victims to people posing as Microsoft technicians, who then push for remote access to the computer. Once a caller controls the device, they can install software and access accounts. Hang up and do not install anything the caller asks for.

### What is Help TDS?

Help TDS is a traffic distribution system that routes visitors from compromised websites, malicious ads, social posts and spam into tech support scams. It checks browser details and location before choosing where to send each visitor. Infoblox researchers assessed that the Russian-language Hotejka affiliate program runs it.

### What should I do if I already gave a scammer remote access?

Disconnect the device from the internet, then change your passwords from a different, clean device, starting with email and banking. Contact your bank or card issuer if you shared account details or sent money. Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov.

### Is Cloudflare responsible for the scam domains?

The reporting does not establish that Cloudflare is at fault. Scammers used the company's free Pages hosting, and one vendor-side analysis calls the problem a structural gap in reputation-based URL filtering rather than a Cloudflare vulnerability. Cloudflare's response was not confirmed in the coverage reviewed.

## Sources

1. [Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams - The Hacker News](https://thehackernews.com/2026/10/help-tds-linked-to-hotejka-as-20000.html)
2. [Hackers Abuse 20,000 Cloudflare Pages Domains to Push Fake Microsoft Security Alerts - Cyber Security News](https://cybersecuritynews.com/cloudflare-pages-domains/)
3. [Researchers trace 20,000 scam domains to Help TDS - Arabian Post](https://thearabianpost.com/researchers-trace-20000-scam-domains-to-help-tds/)
4. [Researchers Uncover 20,000 Malicious Cloudflare Pages Domains Used in Tech Support Scams - GBHackers](https://gbhackers.com/20000-malicious-cloudflare-pages/)
5. [Hackers Use 20,000 Cloudflare Pages Domains to Run a Large-Scale Microsoft Support Scam - Techlomedia](https://techlomedia.in/2026/10/hackers-use-20000-cloudflare-pages-domains-to-run-a-large-scale-microsoft-support-scam-127273/amp/)
6. [Cloudflare (Abused Infrastructure) Vulnerability Rollup (2026-10-16) - Tech Jack Solutions](https://techjacksolutions.com/scc-vendor-rollup/cloudflare-abused-infrastructure-vulnerability-rollup-2026-10-16/)