ClickFix Campaign - DNS Query for Malicious CDN Domain cdnsuicaches.com

Arnold Chan@slaz

•updated Sep 18, 2026•0•0•1

Detects network activity associated with the 'ClickFix' campaign, specifically targeting DNS queries, TLS SNI, HTTP Host headers, and direct IP connections to known malicious infrastructure domains (cdnsuicaches.com, mnl.ac) and exfiltration endpoints (23.227.198.199).