I'm legitimately surprised half the hostnames on the internet isn't serving ClickFix or whatnot payloads already.

The average phpBB or Wordpress, even if it's behind cloudflare, probably has a direct IPv4 that's not disabled.