ClickFix cache smuggling: later-stage servers named by Microsoft — scanned or contacted host

Matches scans of these exact hostnames and their subdomains, and pages whose browser contacted them. A compromised site showing the lure is not expected to contact them, because the victim's computer fetches these stages after the command runs; this anchor follows the servers themselves. Their IP addresses are not included: they are rented virtual servers and shared hosting that change tenants. capsysnet[.]vg answers with the same redirect to that webmail site as servers publicly labelled CountLoader. One of them is alphastore[.]vg, which SOCRadar's August 2026 report lists as a delivery host of the DOUBLECUP ClickFix service and as a CountLoader server. CountLoader is the loader DOUBLECUP is reported to deliver. Its later stages (PowerShell run in memory, then a Python payload started by a scheduled task through pythonw.exe) resemble Microsoft's description. This is an overlap in infrastructure and behaviour, not a confirmed attribution: Microsoft has not named the operator, the browser-cache technique has been public since 2025, and CountLoader was in use before DOUBLECUP.