CopyFail Public PoC Download

Detects the download of the public proof-of-concept exploit script for CVE-2026-31431 (CopyFail) from the known payload domain 'copy.fail'. Attackers or testers may use utilities like curl or wget to retrieve the payload directly to a vulnerable system.