puppys.click KB Sensor Test Fixture
All 4 sensors scoped to puppys.click only — eval_hook, shadow_dom_patch_research, shadow_dom_kb_collection_test, shadow_dom_image_hashes_test.
uid_pattern: ^uid_fefe · url: puppys\.click
eval #1 — ClickFix payload fire
>300 chars and keywords: powershell, curl, iex, frombase64string, verify you are human, Win+R.
eval #2 — short benign no fire
<300 chars, no keywords.
eval #3 — long benign no fire
>300 chars but zero malicious keywords → keyword gate blocks.
eval #4 — short malicious no fire
Has keywords but <300 chars → length gate blocks.
eval #5 — ClickFix with ✅ emoji fire
>300 chars, contains the actual ✅ checkmark emoji + verify + captcha. Tests the Unicode emoji match in payloadMatcher.
HTML Extraction Targets
Practice writing CSS selectors, matchers, and extractors against real HTML structures. No Shadow DOM here — just regular DOM elements.
Login Form
Classic phishing target. Try extracting action attribute, input names, or the form's outerHTML.
Credit Card Form
Payment skimmer target. Multiple input types, autocomplete attributes, and a nested fieldset.
Search Form
Benign form. Try distinguishing it from phishing forms by method="GET", role="search", and absence of sensitive input types.
Suspicious Links
Various link patterns. Practice matching by href regex, target, rel, data-* attributes, or text content.
Navigation Bar
A <nav> with a list of links. Practice targeting by semantic tag, aria-label, or child selectors.
Data-Attribute Rich Element
Element packed with data-* attributes. Practice extracting specific data attributes by name or pattern.
Meta Tags (visible mirror)
Common <meta> patterns rendered as text. Real meta tags exist in <head> — these show what to look for.
Transaction Table
Tabular data with different cell types. Practice extracting by th/td position, row class, or cell content regex.
| Date | Description | Amount | Status |
|---|---|---|---|
| 2026-07-15 | Wire Transfer - Ref #TXN-88201 | $4,250.00 | Completed |
| 2026-07-18 | Crypto Purchase - BTC 0.05 | $3,100.00 | Pending |
| 2026-07-19 | Gift Card Redeem - CODE-XXXX-YYYY | $500.00 | Failed |
Inline Script Tags
Script elements with different types and content. Practice matching <script> by src, type, or inline content patterns.
Iframes
Iframe elements with various attributes. Practice extracting src, detecting sandbox presence, or matching by name/id.
Image Variants
Different image loading patterns. Practice matching src, srcset, loading, alt text, and size attributes.
lazy + alt
empty alt
no alt
data: SVG
Background Image (CSS)
Content loaded via CSS background-image instead of <img>. Not reachable by img[src] selector — needs a different approach.
Urgency / Scam Language
Common scam text patterns. Practice textContent regex matching for urgency, threats, and fake authority.
WARNING: Your account has been compromised! Verify your identity within 24 hours or your account will be permanently suspended.
Congratulations! You've been selected as today's winner. Claim your $1,000 gift card now. Only 3 remaining!
Microsoft Alert: Trojan_Spyware detected. Call 1-800-555-0199 immediately. Do NOT restart your computer.
Welcome back! Your last login was 2 days ago. Check your dashboard for recent updates.
Obfuscated Text
Text with zero-width characters, HTML entities, and Unicode tricks. Practice normalizing before matching.
Password (zero-width joiners between letters)
Account (hex entities spelling "Account")
Аppеl (Cyrillic А and е mixed with Latin)
kcilc ot erehilC (right-to-left override)
CTA Buttons
Different button styles and types. Practice matching by textContent, class, type, data-*, or parent context.
Notification Banner
Cookie consent / notification permission bar. Practice identifying overlay patterns by role, aria-*, position:fixed, and z-index.
This website uses cookies to ensure you get the best experience. By continuing, you agree to our cookie policy.