CheckBot ClickFix kit
CheckBot is a fingerprint gate injected into Joomla menu markup. We have matched it on 168 sites since 24 August.
CheckBot in numbers
Since 24 August, the first CheckBot match in our records, counted on 12 November 2026. How we count.
| Sites with CheckBot code | 168 |
|---|---|
| Sites with a match in the last 30 days | 62 |
| New sites in October | 10 |
| Still serving it when recaptured at least 25 days later | 79 of 105 sites (75%) |
| Sites whose captures requested Joomla core files since 25 September | 94% |
The script tag breaks out of a menu class
ConcAI used the name CheckBot in its analysis of this chain. The injection sits inside the opening tag of a Joomla menu item. It closes the class value, adds a script from /fp/v1.min.js, then leaves the remaining class text and an orphan quotation mark in the source.
Pages with separate desktop and mobile menu modules repeat the injection. The script host changes between sites, while the /fp/v1.min.js path and malformed menu shape remain stable.
fp/v1.min.js filters the visitor
The gate collects canvas and WebGL details, installed-font results, browser and platform fields, plugins, processor count, language, screen size and timezone. It first requests the currently active service domain, then posts the fingerprint to /fingerprint/check. This extra lookup lets the service move without changing the script address already written into the Joomla menu.
ConcAI found the gate continued for selected Windows desktops and left macOS, Linux and mobile visitors on the original page. The filter hides the lure from administrators who browse with a different profile.
The accepted visitor sees three false checks
The accepted path builds a full-page Cloudflare imitation on the compromised site. The visitor sees a "Verify you are human" checkbox, then a false failure that says another verification method is loading. The last screen shows six code boxes and a "Verify now" button.
The actual action sits in a smaller "Get it now" link. Clicking it records the click and downloads a file presented as the validator needed to complete the check.
CheckBot also shares malformed Joomla menu records with SmartApeSG.
What we see
| Month | New sites |
|---|---|
| September | 130 |
| October | 10 |
| November so far | 10 |
Of the 105 sites recaptured at least 25 days after their first match, 79 were still serving CheckBot (75%). Of the sites captured since 25 September, 94% requested Joomla core files.
137 CheckBot sites also carry SmartApeSG.
Checking Joomla menus and requests
Inspect the server's raw HTML, menu records and template output for:
- a
<script>tag inside a menu item's openingclassattribute - orphan class text or quotation marks after that script
- a foreign script path ending in
/fp/v1.min.js - the routes
/domainand/fingerprint/checkin browser or proxy logs - duplicate injections where desktop and mobile menus both render
- a full-page Cloudflare imitation that appears only for selected visitors
Compare affected menu records and template files with clean copies, then purge Joomla and CDN caches. Test from a logged-out Windows browser because the gate filters by the visitor profile.