Infoblox ties the Help TDS traffic distribution system, active since at least 2017, to a Russian-language affiliate program called Hotejka. The Hacker News reports the scams run on more than 20,000 Cloudflare Pages domains and aim to put remote desktop tools on victims' machines.
Reality
- Evidence58
- Adoption50
- Hype gap+10
- Incentives45
- Confidence62
buildOne report1 publisher Two tech-support scams ran ads in AT&T's Yahoo Mail on Oct 7 and 8 that showed a fake Microsoft alert only to Windows desktops on home broadband. In scans by Tuxxin's Daniel Jones, visits from a data center and a phone got an ordinary dating or finance article.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap0
- Incentives35
- Confidence55
Ohio's Bureau of Criminal Investigation traced, froze and returned all $15,300 a 63-year-old woman lost to a fake Microsoft support scam at a crypto ATM. Its unit has worked 309 kiosk cases worth $5.6 million since 2024, so one full refund covers a small part of the losses it is chasing.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives55
- Confidence55
Americans 60 and older filed about 20% of FBI cybercrime complaints in 2025 and bore more than 37% of reported losses. One woman's roughly $100,000 loss over three days, after a fake bank-support handoff, shows why the usual post-scam checklist falls short.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap0
- Incentives20
- Confidence55
MayaBot only shows up in 2022, seven years into the operation, and one branch of the funnel ends in a phone call to a scam call centre. That leaves the search referral and the redirector domains as the constants worth detecting.
Reality
- Evidence46
- Adoption54
- Hype gap+20
- Incentives45
- Confidence63
The callback number in the fake listing had already been used in scams impersonating McAfee and Norton. That makes the phone line the operator's durable asset, and the hosting platform is just an interchangeable front.
Reality
- Evidence32
- Adoption34
- Hype gap+22
- Incentives78
- Confidence45
Malwarebytes took apart a tech support scam page built for iPhones rather than desktops, where the receipt values are hardcoded, the voice comes from the browser's speech API, and the only payload is a phone number.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap−8
- Incentives55
- Confidence58