# Reputation Radar #11: Prove You're Human > This week's smartest bait isn't a link, it's a checkbox. "Prove you're human," it says, then it asks you to paste one line into a terminal. Two crews wrapped that trick in a name you already trust, from a government portal to HBO Max. - Published: 2026-09-16 - Author: Reput.io Team - Tags: Threat Intelligence, Infrastructure Reputation, SOC, Weekly Report - Canonical: https://www.reput.io/blog/reputation-radar-11 --- For years the advice was simple: don't click the strange link. So attackers stopped needing you to. The move landing this month asks you to do something you've been trained to read as *safe*, tick a box that says you're human, and then it quietly hands you a command to run yourself. The trust it borrows isn't a company's homepage. It's the **little security checkpoint you breeze through without thinking**. Two versions surfaced this week, and both wore a name the target already trusted. ## A fake Cloudflare check, on a real government site Red teamer **Vibhum Dubey** found a live one and reported it to STPI and CERT-In: a subdomain of **India's Software Technology Parks (`ananta.stpi[.]in`)**, a government body, was serving a spoofed **"Verify you are human"** page dressed as a Cloudflare check. The page silently pushed a command onto the visitor's clipboard and told them to open Windows Terminal, paste, and hit Enter. That last step is the whole game: this is the **TerminalFix** flavor of ClickFix, where the victim runs the payload themselves and it never crosses a web filter on the way in. The command reached out to `cdn[.]quickdelivr[.]com`, a domain **registered less than a week earlier** and named one careless glance away from the real developer CDN, **jsDelivr**. Registrant in Russia, server in Hong Kong, VirusTotal lighting up on 17 engines by the time anyone looked. Count the borrowed names in a single lure: a **government subdomain**, a **Cloudflare checkbox**, and a **CDN whose name apes jsDelivr**. As Dubey put it, *"What stood out was that this wasn't a shady email or a fake website, it was on a government portal."* Three layers of earned reputation, none of it the attacker's, all of it working for them. ## The same trick, wearing HBO Max It travels well, too. Hudson Rock spent the week untangling a run they call **PasteSwitch**, in which a compromised **HBO Max Reddit account** was used to push ClickFix ads to a media-hungry audience. Different brand, different platform, identical hinge: a recognizable name gets you to trust the page, and the page gets you to paste. That portability is the point. ClickFix and its TerminalFix cousin have caught on because the operator doesn't need a zero-day or a malicious attachment that a gateway can quarantine. They need one trusted surface and one convincing reason to open a terminal. The reputation does the intrusion; the user does the execution. ## What the reputation column shows We ran the two CDN names through our own API to see what a SOC would actually get back. The real one, `cdn.jsdelivr.net`, comes back **whitelisted** and sits inside the **top 1,000 of the Cisco Umbrella list**, and it still resolves to **investigate**, flagged as a high-traffic popular domain. Popularity isn't a clean bill of health; it's precisely what makes a name worth faking. The lookalike, `cdn.quickdelivr.com`, comes back **unknown**: no intel, **zero feed hits**, and also **investigate**. Both answers landed on the same word from opposite directions. The famous CDN earns scrutiny *because* it is famous enough to imitate. The days-old imposter earns it *because* nothing is known about it yet and its name is a near-miss of a name that is. The uncomfortable part is the second one: a defender who only blocks on a feed match would have waved `quickdelivr` straight through, since there was no match to catch. The tell was never a blocklist entry. It was the shape of the thing, a top-tier CDN name minus a few letters, stood up days ago. ## Also on the radar - **Check Point VPN, patch before the weekend.** Two 9.8-rated flaws (**CVE-2026-85102 / CVE-2026-85103**) in Check Point's VPN, and the **Dutch NCSC says exploitation is imminent** ([BleepingComputer](https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/)). Perimeter VPN boxes are the one appliance that faces the whole internet and holds the keys to the inside. - **Cisco Secure Email Gateway zero-day, root access.** **CVE-2026-76461** is being exploited in the wild for root on the appliance, per [Rapid7](https://www.rapid7.com/blog/post/etr-cve-2026-76461-critical-cisco-secure-email-gateway-vulnerability-exploited-in-the-wild/). The box that inspects everyone's mail is a rich place to land. - **A GitLab bug that hands over the CI/CD.** Max-severity **CVE-2026-85706** is now in **CISA's KEV** and under active attack ([BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploit-max-severity-gitlab-flaw-in-attacks/)). A build server owns your source, your secrets, and your release pipeline. - **VMware vCenter RCE, now ransomware's.** CISA flagged a critical vCenter RCE that ransomware crews have picked up ([BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-critical-vmware-vcenter-rce-flaw-now-exploited-by-ransomware-gangs/)). Own vCenter and you own every VM under it. - **One exploit kit, several Chinese crews.** Multiple state-linked groups were seen sharing the same Chrome and Windows zero-day toolkit ("BlueMoon"), a reminder that tooling pools across actors long before attribution catches up ([BleepingComputer](https://www.bleepingcomputer.com/news/security/new-bluemoon-kit-exploited-windows-and-chrome-zero-day-flaws/)). If you want the longer read on why a trusted CDN or cloud in the reputation column is a starting question rather than a green light, we walked through it in [Borrowed reputation: when attackers hide behind trusted infrastructure](/blog/borrowed-reputation-cloud-phishing). See you next week. *Sources are linked inline; credit to the original researchers and reporters. If we got a detail wrong, tell us and we'll fix it.* > **About Reputation Radar:** This is written by the small team building Reput.io, not a marketing department. It's our weekly read on the infosec landscape, with a bias toward the thing we care most about: how attackers borrow the reputation of legitimate infrastructure so their traffic looks normal. Every item links the original reporting, and any claim about our own API is run against it live and labelled.