@rmceoin Very interested if you get around to posting the logic they're using for when to display the ClickFix!
Seeing a compromised site that was reaching out to windlrr[.]com/file.js yesterday, now reaching out to a new initial C2: mermiston[.]com/file.js