ScanMalware.com
Known malicious kitcriticalphishing

ErrTraffic / Exvicy — check-in servers (178.16.52.101, 158.94.208.87) and their rotating domains

family: exvicy-errtraffic-2026-09
Short link:scanmalware.com/h/198

Pages whose ClickFix lure checked in with the rotating status server shared by ErrTraffic-style lures, or that triggered the public Emerging Threats ErrTraffic signatures. Since July 2026 the check-in domains have changed every few weeks, almost all on one address, 178.16.52.101; from mid-September 2026 lovezramexar.info served the same check-in script from a second address, 158.94.208.87.

Anchors

SMQL queryrun
ip:178.16.52.101 OR ids_signature:"ErrTraffic" OR contacted_host:aleverifocation.beer OR contacted_host:wmicconfidance.info OR contacted_host:entry-code-cdn.codes OR contacted_host:fingerprint-veri.info OR contacted_host:fingerprint-verification.info OR contacted_host:analysis-id-fmd.info OR contacted_host:authorization-code-cdn.info OR contacted_host:authorization-id-browser.info OR contacted_host:makeverizyjar.info OR contacted_host:entry-verifed-cdn.codes OR contacted_host:idcool.codes OR ip:158.94.208.87 OR contacted_host:lovezramexar.info

Provenance

Added: 2026-09-23 13:50
Matches the two addresses, the Emerging Threats ErrTraffic signatures, and the check-in domains seen on them: authorization-id-browser.info, authorization-code-cdn.info, analysis-id-fmd.info, fingerprint-verification.info, fingerprint-veri.info, aleverifocation.beer, wmicconfidance.info, entry-code-cdn.codes, entry-verifed-cdn.codes and idcool.codes on 178.16.52.101, lovezramexar.info on 158.94.208.87, plus makeverizyjar.info, which public lists label ErrTraffic. The check-in path shape alone (api.php with a key parameter) is not used, because legitimate applications use it too. Public lists label several of these domains ClearFake and 158.94.208.87 IClickFix; the lure code and the server are ErrTraffic's.
References:

Sightings (868)Atom feed

Showing the 200 most recently scanned.

HostScanScriptMatchScanned
cleo-wasmer-app-deployments.wasmer.app63f41c1e…—query2026-10-24 14:47
pourmontferrier.fr38cce252…—query2026-10-24 01:47
gffworks.com4c8c86c1…—query2026-10-24 00:47
grivettirestauri.it161613c5…—query2026-10-23 17:47
saintpatricksanglicanchurch.orgc0610a78…—query2026-10-23 16:47
browse-veriid.beer71c15358…—query2026-10-21 11:14
browse-veriid.beerbeb2e284…—query2026-10-21 10:30
platinumcarrent.com8349e41f…—query2026-10-21 05:42
ucerma.sk48b70d1e…—query2026-10-20 19:46
bishopsbowlfishery.com7344fe99…—query2026-10-20 19:21
befestigungen24.de554f92f2…—query2026-10-20 19:19
authendigital.iobd8c637b…—query2026-10-20 19:18
aureoforpet.comb0031b30…—query2026-10-20 19:17
auditoriarecords.comf7019106…—query2026-10-20 19:16
atvrentalssedona.net04c8f4d2…—query2026-10-20 19:14
anyonecanread.com78470680…—query2026-10-20 19:12
aniimad.com71e13d3d…—query2026-10-20 19:11
alcoholth.combd70c877…—query2026-10-20 19:09
airconditioncapetown.co.za42420e4e…—query2026-10-20 19:08
5a71.com1d1aa68f…—query2026-10-20 19:05
adelheid-gloeser.frc2888321…—query2026-10-20 19:04
1022studio.com59b4e23f…—query2026-10-20 19:03
drnidhiagrawal.com01a4bede…—query2026-10-20 19:00
drlogan.com.br03ffa1a6…—query2026-10-20 18:59
derma-care.uka3cadb0a…—query2026-10-20 18:54
ctvenki.com.bra45d1ec9…—query2026-10-20 18:50
crestwaterdental.comc49a7f80…—query2026-10-20 18:48
cookinletproperty.com0b48a3da…—query2026-10-20 18:46
constructionsmarttek.com8d6e9e57…—query2026-10-20 18:45
clos3t.io7e5f7089…—query2026-10-20 18:44
classicdigitalindia.com513b8186…—query2026-10-20 18:42
chinaimportswa.com004e5a08…—query2026-10-20 18:40
chaloupecka.cz129875b9…—query2026-10-20 18:39
casaleo-shop.ded10a444c…—query2026-10-20 18:38
canhonamlong.com.vn7090b1f3…—query2026-10-20 18:37
canhtienfarm.com4662ac8d…—query2026-10-20 18:36
cambusa.eu826a97d5…—query2026-10-20 18:34
immer-unter-strom.de4ca88b05…—query2026-10-20 18:33
bursacnc.com4b113f3e…—query2026-10-20 18:31
hgwc.in77756048…—query2026-10-20 18:29
hairandbeauty-lounge.at8fbc5889…—query2026-10-20 18:27
gentacart.my.id1f100858…—query2026-10-20 18:26
gameignition.io2066339d…—query2026-10-20 18:24
flizzyy.com42c2a48e…—query2026-10-20 18:23
flashaquecedores.com.brc1d9ceda…—query2026-10-20 18:21
fitzgeraldsva.com2f99e9c2…—query2026-10-20 18:20
filandoarte.comb8f12b57…—query2026-10-20 18:19
fcs.com.ua8d6f65b1…—query2026-10-20 18:18
fcaes.com.mxac8e6725…—query2026-10-20 18:17
fashionfee.nlb217f3cd…—query2026-10-20 18:14
ezhealthyhabits.com137b3820…—query2026-10-20 18:13
evidance.com.brdc6e861b…—query2026-10-20 18:13
epiccircle.in7c82954e…—query2026-10-20 18:12
envidesign.com8f16c89e…—query2026-10-20 18:11
energyecohub.com.aua6e8423a…—query2026-10-20 18:10
energybf.com1bd90b94…—query2026-10-20 18:09
encodelp.comd71fabd1…—query2026-10-20 18:08
edwardlopezfotografia.come1b3d2ab…—query2026-10-20 18:08
eazyhob.storee207cae6…—query2026-10-20 18:07
mindyoursmallbusiness.comee4faa93…—query2026-10-20 18:06
mhe.engineering93b5d462…—query2026-10-20 18:04
magicartsmaua.com.br964c64ea…—query2026-10-20 18:03
loloops.com4f7c0528…—query2026-10-20 18:02
loolconsulting.ite81c4c5a…—query2026-10-20 18:01
liveliferadiantly.comae8ee172…—query2026-10-20 18:00
limpiezaeventos.com9ba055fc…—query2026-10-20 17:58
lansystem.hu5549a3c2…—query2026-10-20 17:57
joto-hp.jp74750f45…—query2026-10-20 17:56
sachablackbooks.coma98f07e1…—query2026-10-20 17:52
sachablack.co.uk238afee0…—query2026-10-20 17:50
rosales20bar.comd96a3398…—query2026-10-20 17:49
raptors.ptf3758a84…—query2026-10-20 17:47
quickwech.com19799dd1…—query2026-10-20 17:47
ponte.tv6008e039…—query2026-10-20 17:45
pickabagelnyc.combe468d5e…—query2026-10-20 17:44
piscinachivasso.ita11c3237…—query2026-10-20 17:43
unipicase.combeae70ae…—query2026-10-20 17:36
theonedigital.com.brcba5e905…—query2026-10-20 17:32
thegurubarber.com.aud87e7d70…—query2026-10-20 17:31
thefencecompanyonline.com0a287eed…—query2026-10-20 17:30
sutienda.es6ae25e32…—query2026-10-20 17:29
stiltzfranchise.com58186aa8…—query2026-10-20 17:27
strappete.it1e8fae12…—query2026-10-20 17:26
squamishadventure.come5dc75f1…—query2026-10-20 17:24
somachurch.netd9811321…—query2026-10-20 17:24
socolive.cash328d8f28…—query2026-10-20 17:23
sapir-eng.com0299fc80…—query2026-10-20 17:20
xinlin.tw30655283…—query2026-10-20 17:19
woraset-partners.co.th67c55f8b…—query2026-10-20 17:18
winwincookware.comadbb5a5f…—query2026-10-20 17:17
weddart.itba2fe546…—query2026-10-20 17:16
webfischerei.defa44805e…—query2026-10-20 17:15
danabagroup.com8046b8c9…—query2026-10-20 16:57
bcdevelopment.de1246ab16…—query2026-10-20 16:40
findmyperfecthome.co.uk81da899e…—query2026-10-20 16:19
morganaorvokki.com554461af…—query2026-10-20 16:07
wkaikido.pl0e9e3898…—query2026-10-20 14:43
btpwa.org4eae0ed1…—query2026-10-20 14:29
machinegame.com.tw51e12859…—query2026-10-20 14:19
luiseduardo.nete27116bf…—query2026-10-20 14:16
lamiradadelotroediciones.comdcaa5ef5…—query2026-10-20 14:14
kurashitalia.com690777cf…—query2026-10-20 14:14
lottovip.lease5a3cb7c3…—query2026-10-20 14:13
intechpol.pl06ebeffc…—query2026-10-20 14:12
guncelbetvoygiris.com463ea491…—query2026-10-20 14:11
i1-social.come37fba37…—query2026-10-20 14:10
leo88vn.vipb9a56831…—query2026-10-20 14:09
izmirtaskaplama.come74fa774…—query2026-10-20 14:08
iberian-trade.com9c7bcbcb…—query2026-10-20 14:07
produtecnicaagro.com.br6f5396cc…—query2026-10-20 14:04
moncler-outletjackets.us.comef6ae2d8…—query2026-10-20 14:03
ngob.co.za6e5c394c…—query2026-10-20 13:58
photographicmemories.uk.coma00371d7…—query2026-10-20 13:57
nurmas.com.tre671c240…—query2026-10-20 13:55
prefirobh.com.br1b28d1fc…—query2026-10-20 13:53
roadracerx.com82acf5b9…—query2026-10-20 13:52
zenithcomputers.com120a6d85…—query2026-10-20 13:49
xocdiapro.cob47f29f4…—query2026-10-20 13:49
visadubai.com.vn6d3a3bd6…—query2026-10-20 13:46
yumweb.comd7a15ab7…—query2026-10-20 13:45
sandandgarden.com.mx5ce9171c…—query2026-10-20 13:44
tuasesorcontable.com.cod0a9bf28…—query2026-10-20 13:43
ufakick.group36f96cd7…—query2026-10-20 13:42
v2.bulwarrestauracja.pl21129d76…—query2026-10-20 13:41
warpfins.com95a9f8ce…—query2026-10-20 13:40
temdetudoecommerce.com2dd77f07…—query2026-10-20 13:39
ufa365.academy0a93b58e…—query2026-10-20 13:34
reketepizza.com46b45722…—query2026-10-20 13:28
qualicost.come1dfd9bb…—query2026-10-20 13:27
cloud-browse.codesc7d6cf95…—query2026-10-20 12:09
caffe-store-like.beerc717cabf…—query2026-10-20 12:07
caffe-img.com623f61d8…—query2026-10-20 12:06
meritadlaw.com61c66d28…—query2026-10-19 11:28
verifing-server.codes0f689925…—query2026-10-19 08:44
flashlogisticsfzco.com6272702b…—query2026-10-18 17:47
digitalwithkaviya.wasmer.app1236cd1b…—query2026-10-18 17:47
edufreebie2.com284b672f…—query2026-10-17 17:47
comptabilitejoseefortin.comb9a68fe6…—query2026-10-17 17:34
atelierdejulie.comf20c1aed…—query2026-10-17 17:27
vially.consulting5855bbf5…—query2026-10-17 17:14
zehrademirel.com76d37442…—query2026-10-17 16:36
yenimahallepirsultan.org.tr46479641…—query2026-10-17 16:34
browse-id-enter.codes643935ec…—query2026-10-17 14:04
bhumivista.com80356166…—query2026-10-17 11:24
code.nvc-info.beerce518098…—query2026-10-17 11:07
calgarypargingservices.com314ff932…—query2026-10-16 11:26
kiasuplumber.comc59114d3…—query2026-10-16 10:41
fotodiket.seb238d8bf…—query2026-10-15 09:30
butlerskateland.com824ab4f7…—query2026-10-15 01:41
browse-veriid.beer63856083…—query2026-10-15 01:33
ufabet168.wiki0bdd1a34…—query2026-10-15 01:02
thefoodsauciety.co.uk307a8cfa…—query2026-10-15 00:11
buildinganime.unaux.combefca9f2…—query2026-10-14 23:01
aperce.com.co21196ea2…—query2026-10-14 21:28
eneractenergy.comb04def5e…—query2026-10-14 21:16
afconstruc.come02bccdb…—query2026-10-14 21:12
brandbunch.pk24477d68…—query2026-10-14 21:11
bj66.bet4250fb8c…—query2026-10-14 21:07
balconyinspectionlosangeles.comf3f9f208…—query2026-10-14 21:07
arusmrtech.com7110b3ad…—query2026-10-14 21:06
bj66c1.com9aaa28fb…—query2026-10-14 21:05
al-loaloah.comb0878c0a…—query2026-10-14 21:04
bj66khuyenmai.comf401976e…—query2026-10-14 21:03
afrogarnics.us26fc56ec…—query2026-10-14 21:02
988wan.meb579b2f5…—query2026-10-14 21:01
chanjohnsonmusic.com46c50254…—query2026-10-14 21:00
2legendsnyc.com8b0800be…—query2026-10-14 20:59
dunlapconstructionllc.comec1e9755…—query2026-10-14 20:55
andrestaedele.comb35acee5…—query2026-10-14 20:54
autoescolavallecar.com4352f96a…—query2026-10-14 20:52
afforestintl.com18cfe3ae…—query2026-10-14 20:51
bj66bet.comc1c205ac…—query2026-10-14 20:50
cinnalogy.comceb45588…—query2026-10-14 20:48
ararchoir.com21222bc0…—query2026-10-14 20:47
ajudaai.app.bra6eaaf6c…—query2026-10-14 20:46
alamoxsreal.comd5206931…—query2026-10-14 20:45
ahhs.edu.bdb80f6c69…—query2026-10-14 20:44
e-mobilitysearch.com787994bb…—query2026-10-14 20:43
chessplus.edu.vn6d7cb664…—query2026-10-14 20:40
beerbalco.comdc470e0d…—query2026-10-14 20:38
chrismooneysingh.com4d96db9c…—query2026-10-14 20:37
a2a-mednet.com9e2fe5ec…—query2026-10-14 20:34
bewustconsulting.com265cf489…—query2026-10-14 20:33
almonjid.com32c844f0…—query2026-10-14 20:32
algherocar.com7387a609…—query2026-10-14 20:30
btltrimsaccessories.com1b963763…—query2026-10-14 20:28
asturigin.combde66223…—query2026-10-14 20:26
forteprecatorios.com.bra290346f…—query2026-10-14 20:25
3ob.fr123dec7d…—query2026-10-14 20:24
antonicelliformazione.itcea2b499…—query2026-10-14 20:23
centrovertiginitorino.it82f0c1bd…—query2026-10-14 20:22
essexprestigebuildingservicesltd.co.uk4736aed4…—query2026-10-14 20:21
fitneszgoals.com9141d052…—query2026-10-14 20:20
greenwellhealthcare.com0c61000a…—query2026-10-14 20:19
glosamarina.comd86f74a7…—query2026-10-14 20:18
funktionflooring.co.za01250a5c…—query2026-10-14 20:16
lincolnfinancialservicesllc.com0cbe307a…—query2026-10-14 20:13
mauricetalton.com1cd79943…—query2026-10-14 20:12
casinoedenbet.netc6dd7a29…—query2026-10-14 20:09
cananewcity.com.vn861c2449…—query2026-10-14 20:07