ClickFix Payload-as-a-Service API Domain Connection

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•2

Detects outbound network traffic associated with identified ClickFix CPaaS payload domains and associated API endpoints. The rule monitors for specific malicious domain contact (comicstar.lat, babybon.cfd, merkantalolol.asia) and the use of the '/api/index.php?a=init' endpoint, which is indicative of the ClickFix payload delivery mechanism.