ClickFix — Adversary Infrastructure & Temporal Analysis

Domain inventory, hosting analysis, blockchain contract deep-dive, and the predictive intelligence model built from 16 monitoring cycles over 8 days.

See also: clickfix-handoff | clickfix-bddr | clickfix-iocs

---

1. Domain Inventory

Domain	Role	Created	Registrar	Status
idetools.dev	Hijacked entry point	Pre-2026	Unknown (WHOIS empty)	Re-purposed → survey scam
sessionaquirecheck.pages.dev	ClickFix phishing	2026-06	Cloudflare Pages	NXDOMAIN
maccf9c.jetbet4.online	Stage 1 payload	2023-07-06	Namecheap	Cloudflare 403
sj98xe4.xyz	Original C2	2026-05-27	PDR Ltd.	Suspended (clientHold)
apdhlhs3.xyz	Second C2	2026-06-29	Global Domain Group	serverHold
j9af4sr.guru	Third C2	~2026-07-09	WHOIS privacy	Active
62.60.226.50	Hardcoded fallback	2024-10-02	FEMO IT SOLUTIONS (AS214351)	Orphaned
0xA3a603...C2A0	Polygon contract	~2026-05-01	N/A (immutable)	Active — 16+ tx

---

2. Infrastructure Architecture

Victim clicks idetools.dev
    → 302 → sessionaquirecheck.pages.dev (ClickFix)
    → curl | bash → maccf9c.jetbet4.online/script.sh
    → bmodule → eth_call → Polygon contract
    → ABI decode → sj98xe4.xyz (active C2)
    → /upload.php (exfil) + /smodule + /lmodule + /ledger + /shell

Fallback: 62.60.226.50:80 (direct IP, no Cloudflare)

Hosting Analysis

Component	Provider	OpSec Rating
C2 domains (sj98xe4, apdhlhs3, j9af4sr)	Cloudflare proxy	Strong — origin hidden
Phishing page	Cloudflare Pages (free)	Medium — CF can takedown
Payload host (jetbet4)	Cloudflare proxy	Strong
Fallback IP (62.60.226.50)	FEMO IT SOLUTIONS, Germany	Weak — traceable
idetools.dev	MagpieDNS/BrainyDNS	Medium — rotating providers

FEMO IT SOLUTIONS Lead

• ASN: AS214351
• Company: 71-75 Shelton Street, Covent Garden, London — known virtual office / company formation mill
• Thousands of shell companies at this address
• Likely a reseller or bulletproof hosting provider, not the attacker
• The German infrastructure suggests the server is physically in a German datacenter

---

3. TLS Certificate Analysis

Domain	Certificate Issuer	Notes
sj98xe4.xyz	Google Trust Services (via Cloudflare)	Universal SSL
apdhlhs3.xyz	Google Trust Services (via Cloudflare)	Universal SSL
j9af4sr.guru	Cloudflare	Universal SSL
idetools.dev	Let's Encrypt	Direct cert, not Cloudflare

All web IOCs behind Cloudflare present Cloudflare-issued certs. Origin server IP hidden. Takedown must go through Cloudflare Trust & Safety.

---

4. The 40-Day Campaign Window Hypothesis

Analysis of domain registration dates, on-chain activity, and infrastructure lifecycle reveals a calculated operational tempo:

Evidence

Interval	Duration	Event
Contract deploy → C2 #1 registration	~26 days	Infrastructure pre-staging
C2 #1 registration → attack	28 days	Campaign window
Attack → C2 #1 takedown	2 days	Defensive response
C2 #1 takedown → C2 #2 registration	2 days	Recovery
C2 #2 lifespan	9 days	Shorter — more careful
C2 #2 takedown → C2 #3 registration	17 days	Even more careful

The Quant Trading Analogy

The attacker's infrastructure lifecycle resembles algorithmic trading position management:

• Pre-position infrastructure (contract deploy, domain registration)
• Execute (attack)
• Monitor for takedown (defensive response detection)
• Rotate (new domain, new registrar, new TLD)
• Adapt (learn from takedown, tighten OpSec)

Each rotation shows adaptation:

1. Level 1: Change registrar (PDR → Global Domain Group)
2. Level 2: Tighten DNS config
3. Level 3: Change TLD registry (.xyz → .guru)
4. Level 4: Rotate Cloudflare zone

---

5. C2 Domain Rotation History

C2	TLD	Registered	Killed	Lifespan	Recovery	Registrar
sj98xe4.xyz	.xyz	May 27	Jun 27	31 days	2 days	PDR Ltd.
apdhlhs3.xyz	.xyz	Jun 29	Jul 07	9 days	17 days	Global Domain Group
j9af4sr.guru	.guru	~Jul 09	—	Active	—	WHOIS privacy

TLD Migration Significance

The .xyz → .guru shift is strategic:

• .xyz registry (CentralNic) killed both C2 #1 and #2
• .guru is operated by Donuts Inc. — completely different registry, different abuse process
• .guru costs ~$25/year (vs$0.99 for .xyz) — attacker investing more for resilience
• New Cloudflare nameservers: grannbo/kanye — different zone/account

---

6. All 7 Predictions — Confirmed

#	Prediction	Status	Evidence
1	sj98xe4.xyz will be suspended	CONFIRMED Jun 27	clientHold, nameservers → suspended-domain.com
2	Attacker will register new C2 within days	CONFIRMED	apdhlhs3.xyz registered Jun 29 (2 days)
3	New C2 will use different registrar	CONFIRMED	Global Domain Group LLC (vs PDR Ltd.)
4	Polygon contract will be updated	CONFIRMED	16th SetServerURL tx on Jun 30
5	Phishing page will be removed	CONFIRMED	NXDOMAIN by Jul 1
6	idetools.dev will be re-purposed	CONFIRMED	Now redirects to survey-smiles.com
7	BDDR technique prevents permanent takedown	CONFIRMED	3 C2 domains, campaign continues

---

7. idetools.dev IP Rotation (14 Rotations, Full Circle)

After 14 rotations across 5 providers in 15 days, idetools.dev returned to the exact same IP as day 1:

#	Date	IP	Provider
1	Jun 25	208.115.249.238	Limestone Networks
2-13	Jun 26–Jul 09	Various	5 different providers
14	Jul 10	208.115.249.238	Limestone Networks

The parking rotation is a perfect circle — the domain cycles through providers in a managed rotation pattern.

---

8. Longitudinal Monitoring (16 Cycles)

Period: 2026-07-02 through 2026-07-10 Frequency: Every 12 hours (18h operational cycles)

Each cycle documented:

• DNS resolution for all IOCs
• Server headers
• Polygon contract state
• WHOIS status
• Critical findings

Key observations:

• Cycle #1: BDDR confirmed — apdhlhs3.xyz decoded from contract
• Cycle #10-13: sj98xe4.xyz WHOIS status changed to serverHold
• Cycle #16: Third C2 j9af4sr.guru discovered — TLD migration to .guru

---

9. BDDR Theorem (Formally Proven)

THEOREM: Domain takedowns cannot kill a BDDR-based campaign.

EVIDENCE:
  Takedown #1 (Jun 27): C2 dead for 2 days → recovered
  Takedown #2 (Jul 07): C2 dead for 3 days → recovered
  Both times: new domain, updated contract, campaign continues

ATTACKER ADAPTATION:
  Level 1: Change registrar
  Level 2: Tighten DNS config
  Level 3: Change TLD registry
  Level 4: Rotate Cloudflare zone

CONCLUSION: Permanent stop requires:
  1. Remove initial infection vector (idetools.dev link)
  2. OR identify/apprehend contract owner (0x363AeAF1...)

---

10. Abuse Contacts & Takedown Recommendations

Target	Contact	Urgency
j9af4sr.guru	WHOIS registrar + Cloudflare	Immediate
idetools.dev link	Red Hat lsp4ij maintainers	Immediate
0xA3a603...C2A0	Polygonscan community flag	Monitor
62.60.226.50	RIPE abuse, German CERT/BSI	Short-term
jetbet4.online	Namecheap (expired)	Low — natural expiry

Long-term

• Monitor Polygon contract for new SetServerURL transactions
• Track j9af4sr.guru expiry and WHOIS changes
• Flag contract on Polygonscan for community awareness
• Submit to threat intelligence feeds (OTX, MISP, VirusTotal)

---

Source: redhat-clickfix-report/docs/09_infrastructure_analysis.md + monitoring/ cycles 1-16