Back in mid July we thought it would be interesting to track some ClickFix activity and see how the infrastructure supporting it compares with other adversary activity we track. So we added a module to some of our custom telemetry to pull out infrastructure that matched a particular signature that we were seeing used in the campaigns at that time. We hit go and in came a steady feed of ClickFix websites. 

We mostly paid very little attention to this data until today because it seemed pretty quiet, ClickFix wasn't really our core focus, and we had some other, rather interesting, adversary disruption keeping us busy. So, the other day when we did check in and ran a bunch of analysis to understand what themes exist regarding the infrastructure, we were definitely very surprised to see over 13,000 unique entries.

Our analysis showed that this number was primarily the result of a significant spike in mid August, which we have not seen re-surface again, perhaps suggesting ClickFix never achieve the success that some adversaries had hoped, OR, more likely, that ClickFix had already evolved. 

But later on in our analysis we made a much more interesting discovery. That is: over 76% of the ClickFix infrastructure we observed already existed in our Adversary in The Middle (AiTM) dataset. We suspect likely due to a proliferation of as-a-service adversarial tooling operating on top of a layer of compromised infrastructure.

(if you want it you can download our data at the bottom of this blog post)

ClickFix Overview

ClickFix campaigns take advantage of a web page's ability to write to the users clipboard and uses this to try and entice a user to perform a sensitive operation 

Inside Clickfix: what the infrastructure tells us

We set up some detections in mid July 2025 for this infrastructure. This analysis is taking place 2.5 months later and we have compiled a dataset of 13,695 unique hosts which we have associated with ClickFix activity.

Our goal was simply to get a rough indication as to how prolific ClickFix actually is, and whether it is something we should focus some additional effort on. We therefore didn't commit to any real analysis of any of the malware usually distributed by these campaigns, or even the infrastructure hosting the malware. Our focus was purely the initial ClickFix delivery. Essentially, we were interested in, what we would call, the frontend infrastructure supporting these campaigns - i.e. the sites like greenblock[.]me that attempt to get the user to run commands on their system - and that is what the analysis in this blog post is focused on. Specifically we wanted to understand some high level infrastructure trends like "where is this infrastructure hosted?" so that we could compare this with other adversarial infrastructure tracking we do.

Cloudflare everywhere — but not everything

Cloudflare did dominated when it came to hosting this infrastructure, but far less than we had expected to see. In total 24.4% of the infrastructure we observed was sat behind Cloudflare. That's 3,345 out of 13,695 hosts.

These smaller VPS and CDN providers that form the long tail of clickfix infrastructure are interesting and worth watching because they often reappeared across multiple campaigns.

When we exclude Cloudflare from the data we see that across 4 898 non-Cloudflare IP addresses, 2 014 hosted more than one unique clickfix domain - meaning ≈ 41 % of non-Cloudflare infrastructure was used multiple times or was used to host multiple ClickFix domains. The table below shows the top 10 IPs reused across ClickFix campaigns with certain low-cost hosting and reseller networks (Hawk Host, FranTech, Rumahweb, etc.), very much standing out:

Where in the world?

Again, so as not to skew the data too much, we treated "Cloudflare" as a country and then promptly deleted it from our analysis in order to see where in the world most of this infrastructure is being hosted. This reveals a familiar geography for budget hosting and reseller traffic: US, DE, AU, ID, GB, CA, FI, SG, BR, NL. This aligns with large low-cost hosting footprints and regional ISPs where small VPS instances are common.

Indonesia (ID) and Brazil (BR) rank notably high for non-Cloudflare hosting, perhaps suggesting active use of regional providers. Where as Finland (FI) and Singapore (SG) appear as compact hubs despite smaller populations, consistent with data-centre concentration rather than end-user density.

Old domains still matter

Domain age turned out to be an interesting one. When we looked at domain registration date most fell in the past few years, but a visible tail stretched back to the early 1990s.

The oldest domain in the dataset, bmstu.hosting2.acm[.]org, dates to February 1992 and belongs to the Association for Computing Machinery (ACM)’s academic hosting environment. A 30-year-old subdomain showing up in a modern campaign almost certainly means compromise or opportunistic reuse, not deliberate creation. In this case a relatively large shared hosting environment where we expect one of the webservers has been compromised. Other instances are likely due to stale DNS records (subdomain hijacking) and also the misuse of legitimate hosting services too.

The chart below shows the age of domains identified within this dataset:

Abuse of legitimate or institutional infrastructure

To test how often clickfix operations appear on trusted networks, we filtered for restricted domains — those ending in .edu, .ac.*, .gov, or .mil.

The result:

• 100 hostnames (≈ 0.7 %) sat under academic or government domains.
• 14 of those were both old (pre-2015 creation) and restricted.

Examples include small municipal and educational subdomains such as:

www.esus.riachinho.mg.gov.br
semedmaraba.pa.gov.br
www.aprende.tecoc.edu.co
www.admin.zs-borzecin.edu.pl
pelajar.kypj.edu.my

These aren’t "malicious universities" or "rogue governments" (we hope!!) - they’re legitimate sites, or stale DNS records, that attackers have likely compromised.

The bar chart below shows the distribution by TLD family, for these restricted domains.

When we span that out more broadly in order to cover all TLDs we get the following results:

It was a surprise to see .au, .id, .br and .za TLDs rank so highly. Whilst on the topic of domains we thought it might be interesting to see the preferred domain registrar for these ClickFix domains. Out on top came Namecheap by a pretty reasonable margin:

Despite being the most used for hosting Cloudflare didn't feature in the top 10 domain registrars chart, so we ran a quick report to see who internet bad guys hosting behind Cloudflare are using to buy their domains... Turns out they like Namecheap too!

Trends

We've said already that the number of ClickFix instances we'd recorded was a surprise to us because, on occasions when we've checked in on the data feed, it hasn't felt particularly busy. However, when we plot our detections against time we saw very little initially, followed by a notable spike in early to mid August, followed again by very little. Often our daily detection rate of new ClickFix infrastructure doesn't even reach double figures.

Whilst there was a huge spike in mid August for several days what we don't know is whether there were huge spikes elsewhere using evolved ClickFix techniques that we were not picking up. It is, of course, possible that thousands of ClickFix operators concurrently decided to run campaigns at the same time. However, we suspect that instead this was a much smaller number of operators who have access to quite a diverse set of infrastructure to run their campaigns from.