ScanMalware.com
Known malicious kitcriticalphishing

ErrTraffic / Exvicy — check-in servers (178.16.52.101, 158.94.208.87) and their rotating domains

family: exvicy-errtraffic-2026-09
Short link:scanmalware.com/h/198

Pages whose ClickFix lure checked in with the rotating status server shared by ErrTraffic-style lures, or that triggered the public Emerging Threats ErrTraffic signatures. Since July 2026 the check-in domains have changed every few weeks, almost all on one address, 178.16.52.101; from mid-September 2026 lovezramexar.info served the same check-in script from a second address, 158.94.208.87.

Anchors

SMQL queryrun
ip:178.16.52.101 OR ids_signature:"ErrTraffic" OR contacted_host:aleverifocation.beer OR contacted_host:wmicconfidance.info OR contacted_host:entry-code-cdn.codes OR contacted_host:fingerprint-veri.info OR contacted_host:fingerprint-verification.info OR contacted_host:analysis-id-fmd.info OR contacted_host:authorization-code-cdn.info OR contacted_host:authorization-id-browser.info OR contacted_host:makeverizyjar.info OR contacted_host:entry-verifed-cdn.codes OR contacted_host:idcool.codes OR ip:158.94.208.87 OR contacted_host:lovezramexar.info

Provenance

Added: 2026-09-23 13:50
Matches the two addresses, the Emerging Threats ErrTraffic signatures, and the check-in domains seen on them: authorization-id-browser.info, authorization-code-cdn.info, analysis-id-fmd.info, fingerprint-verification.info, fingerprint-veri.info, aleverifocation.beer, wmicconfidance.info, entry-code-cdn.codes, entry-verifed-cdn.codes and idcool.codes on 178.16.52.101, lovezramexar.info on 158.94.208.87, plus makeverizyjar.info, which public lists label ErrTraffic. The check-in path shape alone (api.php with a key parameter) is not used, because legitimate applications use it too. Public lists label several of these domains ClearFake and 158.94.208.87 IClickFix; the lure code and the server are ErrTraffic's.
References:

Sightings (200)

HostScanScriptMatchWhen
fotodiket.seb238d8bf…—query2026-10-15 09:31
butlerskateland.com824ab4f7…—query2026-10-15 01:45
browse-veriid.beer63856083…—query2026-10-15 01:36
ufabet168.wiki0bdd1a34…—query2026-10-15 01:07
thefoodsauciety.co.uk307a8cfa…—query2026-10-15 00:12
buildinganime.unaux.combefca9f2…—query2026-10-14 23:02
aperce.com.co21196ea2…—query2026-10-14 21:29
eneractenergy.comb04def5e…—query2026-10-14 21:17
afconstruc.come02bccdb…—query2026-10-14 21:13
brandbunch.pk24477d68…—query2026-10-14 21:12
bj66.bet4250fb8c…—query2026-10-14 21:09
balconyinspectionlosangeles.comf3f9f208…—query2026-10-14 21:08
arusmrtech.com7110b3ad…—query2026-10-14 21:07
bj66c1.com9aaa28fb…—query2026-10-14 21:06
al-loaloah.comb0878c0a…—query2026-10-14 21:05
bj66khuyenmai.comf401976e…—query2026-10-14 21:04
afrogarnics.us26fc56ec…—query2026-10-14 21:03
988wan.meb579b2f5…—query2026-10-14 21:02
chanjohnsonmusic.com46c50254…—query2026-10-14 21:01
2legendsnyc.com8b0800be…—query2026-10-14 21:00
cinnalogy.comceb45588…—query2026-10-14 21:00
dunlapconstructionllc.comec1e9755…—query2026-10-14 20:57
andrestaedele.comb35acee5…—query2026-10-14 20:55
autoescolavallecar.com4352f96a…—query2026-10-14 20:53
afforestintl.com18cfe3ae…—query2026-10-14 20:53
bj66bet.comc1c205ac…—query2026-10-14 20:51
ararchoir.com21222bc0…—query2026-10-14 20:48
ajudaai.app.bra6eaaf6c…—query2026-10-14 20:47
alamoxsreal.comd5206931…—query2026-10-14 20:46
ahhs.edu.bdb80f6c69…—query2026-10-14 20:45
e-mobilitysearch.com787994bb…—query2026-10-14 20:44
chessplus.edu.vn6d7cb664…—query2026-10-14 20:42
beerbalco.comdc470e0d…—query2026-10-14 20:40
a2a-mednet.com9e2fe5ec…—query2026-10-14 20:40
chrismooneysingh.com4d96db9c…—query2026-10-14 20:38
bewustconsulting.com265cf489…—query2026-10-14 20:34
almonjid.com32c844f0…—query2026-10-14 20:33
algherocar.com7387a609…—query2026-10-14 20:32
btltrimsaccessories.com1b963763…—query2026-10-14 20:30
asturigin.combde66223…—query2026-10-14 20:28
forteprecatorios.com.bra290346f…—query2026-10-14 20:27
3ob.fr123dec7d…—query2026-10-14 20:25
antonicelliformazione.itcea2b499…—query2026-10-14 20:25
centrovertiginitorino.it82f0c1bd…—query2026-10-14 20:24
essexprestigebuildingservicesltd.co.uk4736aed4…—query2026-10-14 20:23
fitneszgoals.com9141d052…—query2026-10-14 20:22
greenwellhealthcare.com0c61000a…—query2026-10-14 20:21
glosamarina.comd86f74a7…—query2026-10-14 20:19
funktionflooring.co.za01250a5c…—query2026-10-14 20:17
lincolnfinancialservicesllc.com0cbe307a…—query2026-10-14 20:14
mauricetalton.com1cd79943…—query2026-10-14 20:13
casinoedenbet.netc6dd7a29…—query2026-10-14 20:10
cananewcity.com.vn861c2449…—query2026-10-14 20:09
bj66.casino4b585e46…—query2026-10-14 20:06
asturigin.com9227f4c5…—query2026-10-14 20:05
antonicelliformazione.it1f18f1fe…—query2026-10-14 20:04
honeybaenailz.com07a4a509…—query2026-10-14 20:02
3ob.frac18bb27…—query2026-10-14 20:00
gruposanluis.edu.pe0d744b3f…—query2026-10-14 19:59
greenwellhealthcare.com8930eeff…—query2026-10-14 19:56
franceprosecurite.fr4e3fe187…—query2026-10-14 19:55
eventor.be075893c5…—query2026-10-14 19:53
energasrj.com.bred27c0d0…—query2026-10-14 19:51
essexprestigebuildingservicesltd.co.uk62636daf…—query2026-10-14 19:50
diariodeestoicos.comb31ca097…—query2026-10-14 19:49
casinoluckmatrix.netf087e867…—query2026-10-14 19:41
centrovertiginitorino.itdb825966…—query2026-10-14 19:40
mhsohan.site87a535fc…—query2026-10-14 19:36
mikesrealestate.co.nz029fe5bd…—query2026-10-14 19:35
mightymastermarketing.comcabac02f…—query2026-10-14 19:34
menara62.comf4e8c0a8…—query2026-10-14 19:33
meerkatplumbing.com6e85cb4b…—query2026-10-14 19:32
maxpaxllc.com3ea4a906…—query2026-10-14 19:30
magnuslegal.in2731f361…—query2026-10-14 19:28
livinghealthwellnessco.comaa7dd22c…—query2026-10-14 19:26
latinaventours.com6d494636…—query2026-10-14 19:23
kurahaastudios.com62934674…—query2026-10-14 19:22
jda-advies.nla539e356…—query2026-10-14 19:19
hotelmadonna.com.ar335c1933…—query2026-10-14 19:16
hoscindia.in2acd736e…—query2026-10-14 19:14
sarandaestates.com6230551c…—query2026-10-14 19:13
radiobumerangtv.comda41545c…—query2026-10-14 19:10
profi-bg.com1fcf92d2…—query2026-10-14 19:09
protego360.com527ef6ac…—query2026-10-14 19:08
propertyexperiencegroup.coma46127b6…—query2026-10-14 19:07
pardazeshsazan.comfc9ca753…—query2026-10-14 19:06
podclubmedia.comc3d6a22e…—query2026-10-14 19:03
playenglishworld.com30b41617…—query2026-10-14 19:01
onihaspells.comdad39668…—query2026-10-14 18:59
ottawacapitalhomes.com1039adb4…—query2026-10-14 18:58
moon-vtc.com5bc32741…—query2026-10-14 18:53
moodesign.mu762ca631…—query2026-10-14 18:52
wordforward.orgf86be25d…—query2026-10-14 18:51
vnbj66.coma7036996…—query2026-10-14 18:50
wehavefeelingstoo.comd80ba17f…—query2026-10-14 18:48
vitalbusinesservices.com6605101c…—query2026-10-14 18:47
uspackagingllc.comd65b5b96…—query2026-10-14 18:46
unaacademiaonline.comc904cdf9…—query2026-10-14 18:45
tocespecialpresentes.com.br62c469d0…—query2026-10-14 18:44
toldosortizrd.com5d2a4a0d…—query2026-10-14 18:41
thetruthaboutmercedes.com4a76816a…—query2026-10-14 18:40
thebigjackpotcasino.neta22090ee…—query2026-10-14 18:39
terrablancamallorca.com3529dbb9…—query2026-10-14 18:38
technogeek.es4a1ee00a…—query2026-10-14 18:37
sumuttoday.com10fe449c…—query2026-10-14 18:35
sunupackaging.com311d9a76…—query2026-10-14 18:35
shifra.org.il63a338cb…—query2026-10-14 18:34
slighfoxinc.com9a39fc1e…—query2026-10-14 18:33
solevento.euf09d0411…—query2026-10-14 18:31
searcomgroup.com522a0684…—query2026-10-14 18:30
satstech.aebb19d816…—query2026-10-14 18:29
yilmazbijuteri.com.tr1e7f1bf5…—query2026-10-14 18:27
xwaycomunicacao.com.br4af8a379…—query2026-10-14 18:26
kingsrxandwellness.comf2bd1375…—query2026-10-14 18:24
litoerre.comba9bbfa8…—query2026-10-14 18:20
nahr-iq.org28c258fe…—query2026-10-14 18:19
regnantitsolutions.combac0b690…—query2026-10-14 18:17
quadhubtrade.comda3c6cce…—query2026-10-14 18:16
nicociucci.com2613a96f…—query2026-10-14 18:15
joseluislacasta.comabee677d…—query2026-10-14 14:40
pachamamaroteisland.com9e067803…—query2026-10-14 14:37
senturkvincyapi.com7f188750…—query2026-10-14 14:36
view360.lkff65c1d5…—query2026-10-14 14:20
stmichaelsway.euffa0b07e…—query2026-10-14 14:18
browse-codes-enter.beer5133cb7b…—query2026-10-14 13:23
marathonspiritueldefes.comc0467ac2…—query2026-10-13 13:14
hello-world-tight-pine-ffda.2383949297.workers.dev1d6ca5de…—query2026-10-12 13:48
limitlessroofingsolutions.co.uk03f33c0e…—query2026-10-12 03:09
korowater.coma649e5ba…—query2026-10-12 03:04
anphutaynguyen.online51173257…—query2026-10-11 23:41
africanyoutharchitects.orgde8ef3b1…—query2026-10-11 23:33
adamconsultings.com48de73bd…—query2026-10-11 22:54
first-frankfurt.de17655f2d…—query2026-10-11 22:44
startne.works51f04970…—query2026-10-11 22:29
zainyapparels.com5c20d218…—query2026-10-11 22:15
sanxuatmay.com81c68276…—query2026-10-11 21:21
minervatics.comfd2491cf…—query2026-10-11 21:15
rickowenwear.com2a86ae97…—query2026-10-11 18:45
brows-check.codesd25a5914…—query2026-10-11 13:34
jabrzoza.eud10449bf…—query2026-10-11 12:41
lydigital.com.brc1efb491…—query2026-10-11 11:51
web.aloha-hk.com6b77b9b2…—query2026-10-11 11:08
turbo-rs.che937bac6…—query2026-10-11 10:33
aguiasmarketing.com.br36fda68c…—query2026-10-11 10:32
bawoyacht.com37485886…—query2026-10-10 21:30
choicepropertynetwork.comd4f31af3…—query2026-10-10 21:30
consultadadosbrasil.api.br3249be16…—query2026-10-10 21:30
mb-consilium.com7174d457…—query2026-10-10 21:30
tarotterapeutico.info346b3a9d…—query2026-10-10 21:30
ukplus.co.kr80198bfa…—query2026-10-10 21:30
velasadagio.com.ar4cc946b1…—query2026-10-10 21:30
skinmyth.pk02d9afe6…—query2026-10-10 21:30
sslazio.world065b0bab…—query2026-10-10 21:30
adventisers.com7cda1cfa…—query2026-10-09 20:44
acoplas.com.br15eeaf0c…—query2026-10-09 20:40
alaasagaa.com68a1af70…—query2026-10-09 20:39
agoraturismo.comb6d3ffc6…—query2026-10-09 20:37
aimbeau.com06118274…—query2026-10-09 20:36
advancedssj.onlinec488eca8…—query2026-10-09 20:35
alfatexsilikon.com2fcb219b…—query2026-10-09 20:33
assamtalks.com68b76f3c…—query2026-10-09 20:26
ankarakampalani.com0ce61f64…—query2026-10-09 20:19
banjarnegeri.idc5f2a001…—query2026-10-09 20:16
allisspace.plbcbaaee2…—query2026-10-09 20:02
butterflytampa.com4b643cdb…—query2026-10-09 19:48
bomhutchankhongorion.com195e99ab…—query2026-10-09 19:40
brotherhoodtattoo.ink13615fd1…—query2026-10-09 19:38
bestsleep-thailand.comf10c5e77…—query2026-10-09 19:32
bipbop-packaging.com170248b8…—query2026-10-09 19:29
corremulherada.com.br63318794…—query2026-10-09 19:28
coalesce-construction.com0f06b85f…—query2026-10-09 19:25
chipndipsauces.co.zacd76f5c4…—query2026-10-09 19:24
casabambuhn.com42530674…—query2026-10-09 19:22
catequilrayotours.com3bedf7fe…—query2026-10-09 19:18
computechniques.com0d8a3a39…—query2026-10-09 19:16
centrecourtslots.comc00fd1ca…—query2026-10-09 19:10
cloverco.comccc68611…—query2026-10-09 19:08
customdesignpackaging.comb4560ad7…—query2026-10-09 18:59
domclinica.com.br424d8144…—query2026-10-09 18:48
digitalcardiocare.comb2a4d075…—query2026-10-09 18:36
dolgozoi-szemelyszallitas-debrecen.hu453f052f…—query2026-10-09 18:35
dentaxclinic.cz9a473057…—query2026-10-09 18:30
envirotechgt.com8af9ffd8…—query2026-10-09 18:26
eldahouara.com50f51fe5…—query2026-10-09 18:23
farmuganda.com14ffbf54…—query2026-10-09 18:19
emlakavrupa.eue63700a0…—query2026-10-09 18:18
evergreenyib.com8ed40bd5…—query2026-10-09 18:14
eelagroupofcompanies.com6893a450…—query2026-10-09 18:04
fashionpointbd.xyzfad104a5…—query2026-10-09 18:03
garagecorriveau.com21bf3968…—query2026-10-09 18:00
gotexasholdempoker.comc3055477…—query2026-10-09 17:56
frpdanismanlik.com9a519083…—query2026-10-09 17:55
global-unaphilippines.org822cac19…—query2026-10-09 17:43
galaxyfurniturestore.com0e3bd51d…—query2026-10-09 17:42
home-tech-repair.space2f553d26…—query2026-10-09 17:30
hiveandhalo.com5c6ce977…—query2026-10-09 17:30
inessalgados.com.brf7625a37…—query2026-10-09 17:23
ikonicv.comd24de97e…—query2026-10-09 17:22
indocommodities.comf43bbabb…—query2026-10-09 17:15
indfleetopsai.comc5662a41…—query2026-10-09 17:13