On maorconsulting.com, Radar intercepted a command during a fake verification flow and captured Windows keyboard and paste instructions. The command was retained for review, never executed.
Daily critical finding · observed
Play walkthroughPause / collapse walkthrough
The original browser screenshot shows a verification lure on the visited site.
Radar intercepts the command-like clipboard write and retains the full safe-display text with its SHA-256.
The next screenshots show Win+X, PowerShell, Ctrl+V and Enter instructions: a request to leave the web page and run pasted text.
The command is never pasted or run. Downstream payload behavior remains unobserved; this sequence illustrates the retained evidence.
Illustrated evidence sequence — not a recording of the website. No commands are run. Reduced-motion mode shows static steps.
What Radar observed
In the original isolated browser session, a verification interaction attempted to copy a PowerShell command. The complete retained text and its SHA-256 were verified. Screenshots show the robot-check lure followed by Win+X, PowerShell, Ctrl+V and Enter instructions. The command requests content from lepafonso[.]bz and pipes the response to Invoke-Expression.
Why it matters
The danger is the move from a web verification prompt into an operating-system terminal. The page asks the visitor to paste a command that would retrieve and execute remote content if run. The observed clipboard write and matching instructions support ClickFix; a familiar logo or a website reputation label alone would not.
Observation limits
This evidence comes from the original 31 October UTC scan, not a claim about every visitor or the current site. Browser request and read-only RPC inspection limits were reached. RPC material was withheld from page execution, leaving downstream behavior unobserved. Radar did not run the PowerShell command, retrieve its payload through that command or establish infection. The walkthrough is an illustration, not a recording.
Recommended response
Close verification prompts that ask you to open Run, PowerShell or Terminal and paste text. Preserve the Radar report for investigation. Defenders can review the full captured command and destination in the source evidence. If a user already executed it, isolate the device and follow incident-response procedures.
Evidence reflects the scan time. A compromised website can change or be repaired; this is not an assertion about every visitor or its current state.