ScanMalware.com
Known malicious kithighphishing

ClickFix: copied Google Merchant Center page on a non-Google domain — page title

family: clickfix-cf-modal-remote-cmd-2026-10

Pages titled like Google's Merchant Center marketing page ('Promote Your Business with Merchant Center') served from domains that are not Google's. In this campaign the copy is hosted on throwaway domains with cooking and grilling names and carries a hidden fake Cloudflare check that copies a command for the Windows Run dialog (Windows key + R, Ctrl+V, Enter).

Anchors

SMQL queryrun
title:"Promote Your Business with Merchant Center" AND NOT domain:google.com AND NOT domain:*.google.com

Provenance

Added: 2026-10-04 13:32
Detector only: a copied title on its own is not proof of malice, so this anchor labels matches without changing a verdict. Google's own domains and their subdomains are excluded. The page-code anchor in the same family is the one that confirms the fake verification box.
References:

Sightings (16)

HostScanScriptMatchWhen
grillgastronomy.com3c8f759b…—query2026-10-04 14:11
grillgastronomy.com056acda9…—query2026-10-04 14:03
yumrecipebox.com355e5846…—query2026-10-04 14:00
thegrillbible.com632d494c…—query2026-10-04 14:00
cookerycircle.com203c19cc…—query2026-10-04 13:47
progrillmenu.com1e206d02…—query2026-10-04 13:47
perfectgrillmeals.com0b7112cc…—query2026-10-04 13:47
pitmasterrecipes.com048b7f06…—query2026-10-04 13:47
kitchensecretbook.com1a1dfeef…—query2026-10-04 13:47
recipebistro.com87e47c94…—query2026-10-04 13:47
pitmasterrecipes.com94f69103…—query2026-10-04 13:36
cookerycircle.com821cc264…—query2026-10-04 13:36
kitchensecretbook.com24a0d0f8…—query2026-10-04 13:36
progrillmenu.com7d6dc713…—query2026-10-04 13:35
perfectgrillmeals.comd5d99de0…—query2026-10-04 13:35
recipebistro.com0d6e88a2…—query2026-10-04 13:35