ScanMalware.com
Known malicious kitcriticalphishing

Exvicy ClickFix — lure and command-and-control domains contacted by a compromised site

family: exvicy-errtraffic-2026-09
Short link:scanmalware.com/h/197

Pages that requested one of the domains published for Exvicy, a ClickFix framework rented out on a Russian-speaking forum since May 2026 and built on reused ErrTraffic code. A script injected into a hacked WordPress site opens a full-screen "Security Check" iframe from these hosts, showing a fake Cloudflare Turnstile challenge that tells the visitor to press Win+R and paste a PowerShell command.

Anchors

SMQL queryrun
contacted_host:cloudflare-check.net OR contacted_host:clickzona.net OR contacted_host:finnancialpl.com OR contacted_host:kawaiininjaclub.cfd OR contacted_host:jouncepopdownloadnow.com OR contacted_host:jumppopdownloadsecret.monster OR contacted_host:lastdayornot.top OR contacted_host:searlepub.com OR contacted_host:whirlpoploaderfast.com OR contacted_host:flarclod.top OR contacted_host:scribblebubblebibi.top OR contacted_host:boundpopclickgetfile.monster OR contacted_host:recaptcha-check.com OR contacted_host:us-addnewdevice.com

Provenance

Added: 2026-09-23 13:50
Exact hostnames only. Includes the lure hosts cloudflare-check.net and clickzona.net, finnancialpl.com (seen serving the same /embed/ lure path, not in the published list), and the published C2 and panel domains. The published list also names many ordinary websites that hosted a panel after being compromised; those are deliberately not matched here, because they are victims.
References:

Sightings (67)Atom feed

HostScanScriptMatchScanned
digitalwithkaviya.wasmer.app1236cd1b…—query2026-10-18 17:47
website-256db78e.sct.lof.mybluehost.mecd6395f4…—query2026-10-16 11:40
wingmanbrewers.combf720ea9…—query2026-10-14 18:48
solis-srl.com66002a26…—query2026-10-14 13:51
simonacheli.com1674c58f…—query2026-10-14 13:50
gotexasholdempoker.comc3055477…—query2026-10-09 17:55
global-unaphilippines.org822cac19…—query2026-10-09 17:42
kartekendustri.com.tr3620701a…—query2026-10-09 16:52
afriserve360.com311a67eb…—query2026-10-09 13:41
axiomrentals.ca626c9466…—query2026-10-09 12:50
cameronvandenbroucke.bef71c9f36…—query2026-10-09 12:06
comment-ca-marche.net334c47f2…—query2026-10-09 11:18
counterpointcleaning.co.ukcba420cd…—query2026-10-09 10:52
dragonsmythslot.comcab78076…—query2026-10-09 10:25
driventradernation.com11d5dce2…—query2026-10-09 10:24
drburakdikmen.comb82bbf63…—query2026-10-09 10:22
elpitallerdeflors.com64da7298…—query2026-10-09 09:53
fastairductcleaningnaples.comebe19924…—query2026-10-09 09:18
nextcars-lease.fr08d9f8d1…—query2026-10-09 04:33
noworriesgaming.com83de3877…—query2026-10-09 04:13
paulikovicsreka.huc1bf8df7…—query2026-10-09 03:51
pmixers.net6471e6a4…—query2026-10-09 03:13
quantica.pro9de4439c…—query2026-10-09 03:09
simonacheli.com0b620494…—query2026-10-09 00:08
solis-srl.comaf088312…—query2026-10-08 23:46
steuern-und-strafe.de78ab4fb1…—query2026-10-08 23:26
taniayovanovic.com7c42474d…—query2026-10-08 22:31
theflb.comaaf48b4e…—query2026-10-08 22:14
temizellerdanismanlik.com.tr78ffd2a6…—query2026-10-08 22:03
sportorium.ptumb.combc9643d9…—query2026-10-08 14:31
wordpress.scanfortruth.comef711599…—query2026-10-08 14:21
azosk.sk1a4d8fab…—query2026-10-08 14:13
legendcup.net7483544c…—query2026-10-04 10:25
louisstructures.com12514fea…—query2026-10-04 10:25
zetaclinic.it6e24e3ab…—query2026-10-04 04:25
247productions.nld54cfa19…—query2026-10-04 04:25
firstcallkuwait.com18888b6c…—query2026-10-04 03:19
fullpowerproperties.uk327dfa14…—query2026-10-03 10:25
theficobooster.com017b752f…—query2026-10-03 04:25
astuces-deco.pro41fe925d…—query2026-10-02 10:25
bigtonypoker.com49831af8…—query2026-10-02 04:25
vanderbilt-park.com7e33ebe2…—query2026-10-01 16:25
diabetescareth.com28812a0f…—query2026-10-01 13:35
checkgps.comb88089c7…—query2026-10-01 13:05
sportorium.ptumb.combdb6c975…—query2026-10-01 13:04
solarcapricornio.com.br429f6353…—query2026-10-01 13:04
browningconsultingtexas.comb11194ac…—query2026-09-23 13:18
condominiojavieracarrera.cla4a304ea…—query2026-09-23 13:17
greenova.app89c2699d…—query2026-09-22 20:47
dolceitalia.org1df3fce5…—query2026-09-20 11:47
harapouya.ir4af84455…—query2026-09-18 15:47
gaviticonsulting.com84c82561…—query2026-09-17 08:47
lmohphotography.com7246fc5e…—query2026-09-17 03:47
womenindev.com5f52b666…—query2026-09-16 02:47
greenbuildingfl.com422343dd…—query2026-09-16 01:47
depannage-rideaux-metalliques-91.comc685e4d6…—query2026-09-15 21:47
multi-sweep.com5d371917…—query2026-09-14 21:47
airbnblistingservice.com00e436bd…—query2026-09-14 21:47
longitudeconstruction.come8c7b1b7…—query2026-09-14 03:47
medmark.sab3dcaa07…—query2026-09-13 14:47
lexperts-comptables.com1f82bdc7…—query2026-09-13 11:47
maximatelecom.net6e8d3bcf…—query2026-09-13 02:47
americanalliancemg.combe174b8f…—query2026-09-13 01:47
opel-hoefler.dee4697c82…—query2026-08-26 23:14
diabetescareth.com15c8216c…—query2026-08-26 23:03
kohatpromotions.comca791ac9…—query2026-08-26 12:40
macroad.ita7182413…—query2026-08-26 07:19