ScanMalware.com
Known malicious kitcriticalphishing

ErrTraffic / Exvicy — check-in server cluster (178.16.52.101 and its rotating domains)

family: exvicy-errtraffic-2026-09

Pages whose ClickFix lure checked in with the rotating status server shared by ErrTraffic-style lures, or that triggered the public Emerging Threats ErrTraffic signatures. Since July 2026 the check-in domains have changed every few weeks while staying on one address, 178.16.52.101.

Anchors

SMQL queryrun
ip:178.16.52.101 OR ids_signature:"ErrTraffic" OR contacted_host:aleverifocation.beer OR contacted_host:wmicconfidance.info OR contacted_host:entry-code-cdn.codes OR contacted_host:fingerprint-veri.info OR contacted_host:fingerprint-verification.info OR contacted_host:analysis-id-fmd.info OR contacted_host:authorization-code-cdn.info OR contacted_host:authorization-id-browser.info OR contacted_host:makeverizyjar.info

Provenance

Added: 2026-09-23 13:50
Matches the address itself, the Emerging Threats ErrTraffic signatures, and the check-in domains seen on it: authorization-id-browser.info, authorization-code-cdn.info, analysis-id-fmd.info, fingerprint-verification.info, fingerprint-veri.info, aleverifocation.beer, wmicconfidance.info and entry-code-cdn.codes, plus makeverizyjar.info, which public lists label ErrTraffic. The check-in path shape alone (api.php with a key parameter) is not used, because legitimate applications use it too. Public lists label several of these domains ClearFake; the lure code and the server are ErrTraffic's.
References:

Sightings (141)

HostScanScriptMatchWhen
motherload.med59e34b8…—query2026-09-30 01:50
alcoawheels.impar.ro57fa8568…—query2026-09-26 01:49
aerofisic.com.br0423984f…—query2026-09-25 14:21
aerofisic.com.brf0200aff…—query2026-09-25 14:21
contentcareer.com8cb96fe2…—query2026-09-23 13:50
driftwoodresortmn.com77c7f38b…—query2026-09-23 13:50
davariyabrothers.com09d57c04…—query2026-09-23 13:50
browningconsultingtexas.comb11194ac…—query2026-09-23 13:50
alholol-almobtakara.comf3b35f1c…—query2026-09-23 13:50
pacharagems.com0ca60b62…—query2026-09-23 13:50
condominiojavieracarrera.cla4a304ea…—query2026-09-23 13:50
dogotuanhung.com75c69d34…—query2026-09-23 13:50
bistreet.cz424c703e…—query2026-09-23 13:50
actingandvoice.co.uk01cd7273…—query2026-09-23 13:50
actingandvoice.co.uk8697faba…—query2026-09-23 13:50
sportsministry.infoa4d1d61d…—query2026-09-23 13:50
ablecasinos.comc54eadc9…—query2026-09-23 13:50
eurocomfrance.frbb2a8604…—query2026-09-23 13:50
thefiremanconstruction.comdcded53e…—query2026-09-23 13:50
noticias29.coma9de6622…—query2026-09-23 13:50
lapcfprotectionincendie.fr1eaf39b7…—query2026-09-23 13:50
noticiasaltiempo.comd7b91550…—query2026-09-23 13:50
etigroup.inc7314afc…—query2026-09-23 13:50
motorway.nl38cb4f3e…—query2026-09-23 13:50
newdigimatic.comd49e3ae6…—query2026-09-23 13:50
entry-code-cdn.codesbb2a8d04…—query2026-09-23 13:50
grandviewcateringtc.comeb3a0aa8…—query2026-09-23 13:50
buletinnews.ida9de66a5…—query2026-09-23 13:50
fahrschule-heidisch.de76d31efb…—query2026-09-23 13:50
elinfame.com73cd2c3a…—query2026-09-23 13:50
betonicehockey.com865c6083…—query2026-09-23 13:50
mstclaudens.beer641295cf…—query2026-09-23 13:50
zaasproperty.comb427c3bf…—query2026-09-23 13:50
dxghq.coma54606e6…—query2026-09-23 13:50
edumenezes.com.br50d86622…—query2026-09-23 13:50
farmtasticdoggy.com.au6568b89b…—query2026-09-23 13:50
the-speech-house.co.uk8d3fdca6…—query2026-09-23 13:50
liyrkan.coma1e7544f…—query2026-09-23 13:50
elegancedrycleaner.comded364de…—query2026-09-23 13:50
elektrikclothing.com5f4b4cd3…—query2026-09-23 13:50
circaire.com4e36e012…—query2026-09-23 13:50
stratumrs.comccb16a2d…—query2026-09-23 13:50
fressroom.comdd5d274f…—query2026-09-23 13:50
seniorenzentrum-bn.de004d183b…—query2026-09-23 13:50
laboriewines.co.za31cfdb72…—query2026-09-23 13:50
dannadottorgiuseppe.it3f7b8246…—query2026-09-23 13:50
marathonspiritueldefes.com8dd25257…—query2026-09-23 13:50
medina-online.defb2ae78b…—query2026-09-23 13:50
mygrowingmilestones.com57b1f99a…—query2026-09-23 13:50
harapouya.ir4af84455…—query2026-09-23 13:50
navscorp.comd2b7d891…—query2026-09-23 13:50
vgavoile.orgd49c69df…—query2026-09-23 13:50
nvo-alternative.org28457d8c…—query2026-09-23 13:50
ibericahost.eu25ac5068…—query2026-09-23 13:50
aleverifocation.beer5c054965…—query2026-09-23 13:50
brondelloerminio.itd5139972…—query2026-09-23 13:50
gaviticonsulting.com84c82561…—query2026-09-23 13:50
monocafe.com.pl5cef15d1…—query2026-09-23 13:50
calisourcing.com2ff3ebac…—query2026-09-23 13:50
eastmont.net06705a67…—query2026-09-23 13:50
curier.ro272fdbb8…—query2026-09-23 13:50
maryolanieto.com7a185661…—query2026-09-23 13:50
vertixtech.net074a56a1…—query2026-09-23 13:50
lmohphotography.com7246fc5e…—query2026-09-23 13:50
andrewsenterprises.org803bd6ef…—query2026-09-23 13:50
simplistica.net00923f9b…—query2026-09-23 13:50
austin-kimbermodernhotel.info4bbc1b19…—query2026-09-23 13:50
isatech.biz369ab31d…—query2026-09-23 13:50
mghirealty.com8b5aaa88…—query2026-09-23 13:50
makepiecestudio.com3786d00d…—query2026-09-23 13:50
kasperky-dent.czca665bd3…—query2026-09-23 13:50
acmbio.escef193d6…—query2026-09-23 13:50
winnernet.net7d6d05c4…—query2026-09-23 13:50
cocotubatucada.come4c50122…—query2026-09-23 13:50
canjanetcerdanya.come8350904…—query2026-09-23 13:50
womenindev.com5f52b666…—query2026-09-23 13:50
greenbuildingfl.com422343dd…—query2026-09-23 13:50
studiopilates-one2one.it22e4735c…—query2026-09-23 13:50
toolsinformer.comef7ad2bc…—query2026-09-23 13:50
stcconsulting.fr5d9add2b…—query2026-09-23 13:50
depannage-rideaux-metalliques-91.comc685e4d6…—query2026-09-23 13:50
boldaxyl.com0d171710…—query2026-09-23 13:50
6gems.gr633fc7b7…—query2026-09-23 13:50
realizimmo.bed8f168cc…—query2026-09-23 13:50
obdecor.es7fb24cbe…—query2026-09-23 13:50
stampa70.com9bebfbcc…—query2026-09-23 13:50
junge-sinfonie-berlin.de64396994…—query2026-09-23 13:50
thrivebeauty.co4d0a764d…—query2026-09-23 13:50
diplomatmontessori.co.zadc0bdc1c…—query2026-09-23 13:50
efestotrainingclub.it80ab5c8c…—query2026-09-23 13:50
thammyhoavy.vnce71d9bb…—query2026-09-23 13:50
miremolnar.combb1c524a…—query2026-09-23 13:50
globalpath.net2ae14a48…—query2026-09-23 13:50
sebikft.hu2be577cd…—query2026-09-23 13:50
interboor-midsland.comae3dfb9b…—query2026-09-23 13:50
airbnblistingservice.com00e436bd…—query2026-09-23 13:50
pgrealtyhomes.comf15baeb5…—query2026-09-23 13:50
mobel.co.za8477a665…—query2026-09-23 13:50
yypost-main.net46f8be36…—query2026-09-23 13:50
vtsc.asiaf37225d1…—query2026-09-23 13:50
sohonailbar.es3e153c90…—query2026-09-23 13:50
koun.orga0d9d2f5…—query2026-09-23 13:50
pizzeriadilucca.nl35d11b06…—query2026-09-23 13:50
glowbeautybd.com3b98b242…—query2026-09-23 13:50
partymaniacy.pl5771edf4…—query2026-09-23 13:50
longitudeconstruction.come8c7b1b7…—query2026-09-23 13:50
vialignum.comc1f3d96b…—query2026-09-23 13:50
joanmbrooks.comeb1edef5…—query2026-09-23 13:50
check.first-node.rocks4044db15…—query2026-09-23 13:50
diayazilim.comcdf94460…—query2026-09-23 13:50
stengel-immobilienservice.de3740a6fc…—query2026-09-23 13:50
agripiumacchinari.ite07e18c7…—query2026-09-23 13:50
vdsverhuur.be5621ec74…—query2026-09-23 13:50
tymvideoproduction.frf07a3202…—query2026-09-23 13:50
mr-ansarian.ird8b645e7…—query2026-09-23 13:50
medmark.sab3dcaa07…—query2026-09-23 13:50
travelindiadifferently.fr08d1a159…—query2026-09-23 13:50
wiltsi.dec6a0859b…—query2026-09-23 13:50
lexperts-comptables.com1f82bdc7…—query2026-09-23 13:50
biogranul.com7d260719…—query2026-09-23 13:50
swisslearn.org635ba94e…—query2026-09-23 13:50
maximatelecom.net6e8d3bcf…—query2026-09-23 13:50
americanalliancemg.combe174b8f…—query2026-09-23 13:50
ugvglobal.coma841da46…—query2026-09-23 13:50
1to1meet.coma8692c76…—query2026-09-23 13:50
123codage.com51d238f8…—query2026-09-23 13:50
peatsorbng.azurewebsites.net4f76c152…—query2026-09-23 13:50
opel-hoefler.dee4697c82…—query2026-09-23 13:50
diabetescareth.com15c8216c…—query2026-09-23 13:50
kohatpromotions.comca791ac9…—query2026-09-23 13:50
heartandshape.com1e118494…—query2026-09-23 13:50
tecnogermana.com444ecfbf…—query2026-09-23 13:50
macroad.ita7182413…—query2026-09-23 13:50
kingdomdoghotel.com5ff0d4d4…—query2026-09-23 13:50
institutovitoria.comd7ab09ea…—query2026-09-23 13:50
analysis-id-fmd.infob59c7add…—query2026-09-23 13:50
cisis.it19bda9e0…—query2026-09-23 13:50
zahratalmaghrib.com1d9071ef…—query2026-09-23 13:50
zahratalmaghrib.com1649a0ac…—query2026-09-23 13:50
authorization-press-enter.infof2d37d9c…—query2026-09-23 13:50
authorization-code.infof8acbcdc…—query2026-09-23 13:50