About

Who runs this site, and why it exists

ClickFixReport is a one-person project. It indexes publicly reported ClickFix and FakeCAPTCHA campaigns, keeps the credit attached to the researchers who found them, and makes the whole thing free to read and free to reuse.

Who

My name is Antonio Radu. I am an independent security researcher. I also run intelfusions.com, a threat-intelligence site covering a much wider set of topics. The two are separate properties with the same owner, and I say so here rather than leaving you to work it out from a WHOIS record. Nothing on ClickFixReport redirects to IntelFusions, and no page here exists in order to send you there.

I am not a company, a vendor, or a research team. There is one person behind every judgement call on this site, and the methodology page describes exactly which of those calls are made by a human and which are made by software.

Why

ClickFix is unusually well covered and unusually badly indexed. Vendors and independent researchers publish careful analysis of it constantly. That analysis is scattered across dozens of blogs, it uses inconsistent names for the same activity, and a meaningful share of it goes offline within two years of publication. The indicators inside those posts are the first thing to disappear and the hardest thing to search for afterwards.

Meanwhile the reputation databases have the opposite problem. They will tell you that a host was flagged, but not who reported it, not what the campaign was, not whether the site was attacker-registered or somebody who got hacked, and not what the report actually said.

This site sits in that gap. It keeps the observation, the date, the publisher and a link to the original, all attached to each other permanently, plus a private copy of the source text that every indicator is checked against. Nothing here replaces the original research, and every page says so with a link at the top.

How it is paid for

Out of my own pocket. The running cost is small by design: static pages, a managed database on a free tier, and a build that is deliberately boring. There is no venture money, no vendor sponsorship, no advertising, no affiliate links, and no newsletter selling anything.

Three commitments follow from that, and they are the ones worth writing down:

• No paid placement. Nobody can pay to have a campaign, a vendor or a product appear on this site.
• No paid removal. Nobody can pay to have an entry taken down. Corrections are free, and so is suppression when the evidence supports it.
• No commercial tier. There is no paid API, no premium feed, and no reason for this site to make its free data worse over time.

What this is not

• Not a blocklist. Many hosts on this site are compromised legitimate websites whose owners are victims. Only attacker-controlled infrastructure reaches the blocklist export, and even that deserves your own review. See the disclaimer.
• Not a detection or sandbox service. Nothing is detonated here, no samples are hosted, and no live payload is served to anybody for any reason.
• Not attribution research. ClickFix attribution is thin and contested. This site records what named sources observed; it does not name actors on its own authority.
• Not a news site. It is a record. Entries are dated observations, and old entries stay up with their dates intact rather than being quietly refreshed.

Where software ends and a person begins

A language model reads each source report and emits structured fields: indicators, dates, techniques, target platforms. It never writes the prose you read on a campaign page, and it has no authority to publish anything. Summaries are composed from those fields in our own words. A human reviews every campaign before it goes live. A blind weekly re-check of a random sample of already-published items is defined but has not yet run; the error rate it measures is published, whatever it says, on /methodology.

Contact

If a listing concerns a site you own, use the dispute process — it reaches the same person, with the context already attached.