Free feed · sign-up required
Block ClickFix at the domain and URL level
PrecisionSec tracks active ClickFix lure domains, distribution URLs and C2 in real time. Sign up and get the full feed: every indicator, no defanging, free forever.
Free forever · no credit card · delivered as CSV
This is what your users are being told to run. Here's every domain serving it, free.
Drops straight into the tools your SOC already runs
What you get
The full feed, free
- The full feed, not a sample: every lure domain, distribution URL and C2 indicator
- Refreshed as fast as every minute
- Delivered as a CSV feed link
How it works
Live in your stack in one business day
- Sign up with your work email
- We email your CSV feed link within one business day
- Pull ClickFix IOCs into your SIEM, firewall or TIP
Why free?
ClickFix moves fast, and targets everyone
ClickFix is one of the fastest-growing initial-access techniques, and it doesn't discriminate by industry or company size. Getting these indicators into more defenders' hands shrinks the window attackers count on. The full ClickFix feed is our standing free tier: a 15-day trial opens every other malware, C2 and ransomware feed we track.
See it live
Live ClickFix indicators, pulled straight from our threat feed and refreshed as fast as every minute. Sign up below to get the full, un-defanged feed.
| First seen | Indicator | Type | Confidence |
|---|---|---|---|
| 3m | secure-update-cdn[.]net | C2 domain | High |
| 9m | 91.213.50[.]114 | C2 IP | High |
| 15m | api-telemetry-sync[.]com/load | Payload URL | High |
| 22m | b7e2f48c…3d90af | SHA256 Hash | Medium |
| 38m | node-relay-7f1c[.]org | C2 domain | High |
Get access
Get your free ClickFix feed
Once approved, your CSV feed link lands in your inbox, ready to pull into your SIEM, firewall or TIP.
Want the full picture?
The ClickFix feed is free forever as CSV. Start a 15-day trial for every other malware, C2 and ransomware feed, plus STIX/TAXII, MISP and API delivery.