Scan report · about 1 month agoPublic

www.group-ib.com

172.67.69.208AS13335 · US

Submittedhttps://www.group-ib.com/blog/clickfix-the-social-engineering-technique-hackers-use-to-manipulate-victims/

Verdict

1 of 7 enginesSuspiciousAutomated

Be careful — warning signs found

Automated

Its form submits what you type to a different website than the one you are on. This site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.

What to do

Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.

"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.

Findings

Strongest first

Suspicious fileSuspicious content in the downloaded file

be82238d-fb80-428c-84a6-bcdc50ad1651.html

Our Content Inspection engine downloaded the file this URL serves and analyzed it. The payload shows traits commonly seen in malware. Treat it as unsafe until verified.

Success

SHA-256 599a96471d35c485d6a8ca1d21ec2b303d17568529d958eded8a5b8928ad70cd

InfoCross-domain scripts injected at runtime

33 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

Infrastructure

IP: 172.67.69.208CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=WE1, O=Google Trust Services, C=US · expires Nov 23, 2026

WHOIS

Registrar: GoDaddy.com, LLC
Created: Oct 2, 2008
Expires: Oct 2, 2027
Nameservers: dora.ns.cloudflare.comtom.ns.cloudflare.com

19 malicious5 suspicious

Hashes & fingerprints

Page Hash02c9a10d10f7ed6668b9b272408a387a7d8208e65220c93f48b4ea4fda3da45b Favicon Hash1be7918da1e16eb032883c8c711b29a2a339584b51bfcae897e36e6f1b568f63 DOM Hashab97c02c27d66a523296469f51b930d754b6a0a87a217d615183ee28777bb48f Screenshot pHashfffb5454005f1454 JARM00000000000000000042d43d00041da8040ca1d7d1b3e955a3535eb361ef06 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintA8FDB1EA79F79ADFCEAD53F1E5B0FA643A888D09 Cert IssuerCN=WE1, O=Google Trust Services, C=US

Page capture

Live

Title “ClickFix Attack: How ClickFix Malware Scam Works | Group-IB”

Visit Site

Engines

7 · time to verdict