Domain on record
domain, shown defanged for safety: nontextileify dot live
Ownership assessment
Set up by the attacker.
Our sources describe this domain as infrastructure created for the campaign, rather than a legitimate service that was broken into. No third party is harmed by its appearance in this record.
Blocking
This is the only class we consider safe to block outright, and the only class that appears in the blocklist export files.
Campaigns referencing this domain
Where this came from
Reported by Stormshield Customer Security Lab on 2026-03-13
Investigations into the MIMICRAT ClickFix campaign
Recorded as domain, shown defanged for safety: nontextileify dot live · Payload host · extracted by Machine-extracted, human-reviewed
Observation timeline
No checks are recorded for this domain. It has not been through enrichment, which means nobody has looked at whether it still resolves, where it points, or whether it has been taken down.
An empty timeline is a statement about our coverage and nothing else. It is not evidence that the domain is inactive, and it is not evidence that it is live. The dated observations from published sources, further up this page, are the only claims we are making.
What to do with this
Recorded as attacker-controlled by the sources above. If you saw traffic to it, treat the originating host as having reached a ClickFix lure and work through the response steps for Windows or macOS.
Found an error? Tell us — disputed entries come down the same working day, before we decide whether the dispute is right.
Cite as
ClickFixReport, “nontextileify[.]live”, indicator ID c1e9bf66-86d1-4694-bcff-6b38e4adb69d, retrieved 2026-08-15.
https://clickfixreport.com/domains/nontextileify.live
Published under CC BY 4.0. Reuse it, including commercially, with attribution. The date above is when this record last changed, not when you opened it — the page is a versioned record, so that is the date a reader needs to find what you saw.