ClickFix fake Cloudflare verification pages that pull their next stage over the finger protocol

Tracks a ClickFix kit that runs on its own freshly registered domains instead of injecting itself into compromised sites. The page imitates a Cloudflare interstitial titled "Verification", drawn from two images embedded in the page itself, so the look needs no external request and survives being saved or re-hosted. Clicking the fake checkbox copies a Windows command to the clipboard and tells the visitor to paste it into the Run box. The command is what sets this kit apart: it assembles the name of the finger client at run time, either with caret separators or by joining two fragments, and then uses that legacy service to pull its next stage over TCP port 79 rather than over HTTP. The user name in the finger request is a token unique to each visitor, which lets the operator confirm from the server side that a particular visitor ran the command. Matches the kit's own page structure and the request the page makes the moment the checkbox is clicked.