ClickFix: hidden fake Cloudflare check that fetches the Win+R command on click — page code

Throwaway domains with cooking and grilling names (recipebistro[.]com, kitchensecretbook[.]com, progrillmenu[.]com, perfectgrillmeals[.]com and many similar) that serve a copy of Google's Merchant Center marketing page. Any click on a link or button opens a fake Cloudflare / reCAPTCHA verification box that tells the visitor to press Windows key + R, then Ctrl+V, then Enter. At the same moment the page downloads the command text from its server and places it on the clipboard, so the command never appears in the page itself. Seen since early September 2026, each domain on its own rented server. In early October 2026 the operator had left the command address unfilled ({{WINR}}), so the copied text was the page itself; the same page becomes dangerous as soon as a real address is filled in. No legitimate verification step asks visitors to run a command.