Infoblox traces Help TDS tech support scams to Hotejka, an apparent ROI777 rebrand
Infoblox ties the Help TDS traffic distribution system, active since at least 2017, to a Russian-language affiliate program called Hotejka. The Hacker News reports the scams run on more than 20,000 Cloudflare Pages domains and aim to put remote desktop tools on victims' machines.
Reality
- Evidence58
- Adoption50
- Hype gap+10
- Incentives45
- Confidence62
Google paid up to triple the going rate for fiber that routes around the Red Sea
Google paid two to three times the roughly 6 million euro going rate for backup fiber across Turkey, according to a person familiar with the deal. Most Europe-Asia cloud traffic still crosses the contested Red Sea strait, so the premium buys a route for the day a cable breaks.
Reality
- Evidence45
- Adoption35
- Hype gap+15
- Incentives55
- Confidence45
buildOne report1 publisher Synthient wants residential proxy flags on IPs to carry a provider and a timestamp
Synthient says residential proxy traffic it observed in May 2026 touched about 9.2 million domains through household IPs that real users also share. Its answer is to timestamp each proxy sighting and set friction by what the session is trying to do.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+20
- Incentives85
- Confidence45
Infoblox Threat Intel says dropcatch registrations are now close to one in five new domains, and one actor spent over $7 million on 10,000 of them. Clean history is being bought, not earned.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives
- Not scored
- Confidence55
SOCRadar's teardown of the AnonyMousKIT service found 200 AI-voiced calls at about $0.10 each, most of them to Brazil. The skill in phone social engineering is now a script file.
Perspective Coverage
4 publishers
- Builder
- Builder 19%
- Operator
- Operator 76%
- Investor
- Investor 5%
Reality
- Evidence70
- Adoption40
- Hype gap+35
- Incentives40
- Confidence65
The Justice Department seized this service's original domain in December 2022 and arrested six people. The FBI has now taken two more of its domains, and the warrant affidavit counts hundreds of thousands of attacks since 2022.
Perspective Coverage
6 publishers
- Builder
- Builder 18%
- Operator
- Operator 74%
- Investor
- Investor 8%
Reality
- Evidence70
- Adoption60
- Hype gap+25
- Incentives40
- Confidence70
IDScan.net is notifying people about names and ID numbers and offering credit monitoring, while the records Brian Krebs examined each carried infrared and ultraviolet captures, the layer that document authentication actually tests.
Perspective Coverage
4 publishers
- Builder
- Builder 22%
- Operator
- Operator 59%
- Investor
- Investor 19%
Reality
- Evidence82
- Adoption68
- Hype gap+12
- Incentives55
- Confidence76
GTA VI leak: extortion leverage moves from the regulator to the fanbase
CyberLeek's drip-feed of stolen footage carries no notification clock. Take-Two's answer has been DMCA subpoenas, and researchers read the case as an insider threat investigation.
Reality
- Evidence52
- Adoption45
- Hype gap+22
- Incentives68
- Confidence48
A free graph of ads.txt now shows which data brokers your own site authorised
DecryptAds cross-references ads.txt, app-ads.txt and sellers.json into one searchable view. In ESPN's files it counts 143 ad partners and 19 registered data broker domains.
Reality
- Evidence55
- Adoption20
- Hype gap+18
- Incentives70
- Confidence55