CFM

Clickfixmap

Paste a third-party script or page URL → SSRF-safe fetch + multi-DoH + ClickFix / SRI / edge-rewrite case file (A–F).

Brevo-class supply-chain wedge HTTPS only · private IP blocked Fixture demos · no live malware required

Script or page URL (HTTPS) Claimed vendor (optional)

Treat as HTML page (SRI scan)

Demo uses synthetic fixtures only (clickfix_lure / clean_analytics). Never run pasted Win+R commands on a real machine.

Passive public OSINT heuristics. Not a sandbox, not legal advice, not vendor attestation. Synthetic demos never include personal identifiers. Built for ecommerce/security teams watching marketing embeds after Brevo-class edge rewrites.