ScanMalware.com
Known malicious kitcriticalphishing

Exvicy ClickFix — lure and command-and-control domains contacted by a compromised site

family: exvicy-errtraffic-2026-09
Short link:scanmalware.com/h/197

Pages that requested one of the domains published for Exvicy, a ClickFix framework rented out on a Russian-speaking forum since May 2026 and built on reused ErrTraffic code. A script injected into a hacked WordPress site opens a full-screen "Security Check" iframe from these hosts, showing a fake Cloudflare Turnstile challenge that tells the visitor to press Win+R and paste a PowerShell command.

Anchors

SMQL queryrun
contacted_host:cloudflare-check.net OR contacted_host:clickzona.net OR contacted_host:finnancialpl.com OR contacted_host:kawaiininjaclub.cfd OR contacted_host:jouncepopdownloadnow.com OR contacted_host:jumppopdownloadsecret.monster OR contacted_host:lastdayornot.top OR contacted_host:searlepub.com OR contacted_host:whirlpoploaderfast.com OR contacted_host:flarclod.top OR contacted_host:scribblebubblebibi.top OR contacted_host:boundpopclickgetfile.monster OR contacted_host:recaptcha-check.com OR contacted_host:us-addnewdevice.com

Provenance

Added: 2026-09-23 13:50
Exact hostnames only. Includes the lure hosts cloudflare-check.net and clickzona.net, finnancialpl.com (seen serving the same /embed/ lure path, not in the published list), and the published C2 and panel domains. The published list also names many ordinary websites that hosted a panel after being compromised; those are deliberately not matched here, because they are victims.
References:

Sightings (65)

HostScanScriptMatchWhen
wingmanbrewers.combf720ea9…—query2026-10-14 18:49
solis-srl.com66002a26…—query2026-10-14 13:53
simonacheli.com1674c58f…—query2026-10-14 13:51
gotexasholdempoker.comc3055477…—query2026-10-09 17:56
global-unaphilippines.org822cac19…—query2026-10-09 17:43
kartekendustri.com.tr3620701a…—query2026-10-09 16:54
afriserve360.com311a67eb…—query2026-10-09 13:42
axiomrentals.ca626c9466…—query2026-10-09 12:56
cameronvandenbroucke.bef71c9f36…—query2026-10-09 12:07
comment-ca-marche.net334c47f2…—query2026-10-09 11:20
counterpointcleaning.co.ukcba420cd…—query2026-10-09 10:58
dragonsmythslot.comcab78076…—query2026-10-09 10:27
driventradernation.com11d5dce2…—query2026-10-09 10:25
drburakdikmen.comb82bbf63…—query2026-10-09 10:24
elpitallerdeflors.com64da7298…—query2026-10-09 09:58
fastairductcleaningnaples.comebe19924…—query2026-10-09 09:20
nextcars-lease.fr08d9f8d1…—query2026-10-09 04:35
noworriesgaming.com83de3877…—query2026-10-09 04:14
paulikovicsreka.huc1bf8df7…—query2026-10-09 03:56
pmixers.net6471e6a4…—query2026-10-09 03:15
quantica.pro9de4439c…—query2026-10-09 03:12
simonacheli.com0b620494…—query2026-10-09 00:10
solis-srl.comaf088312…—query2026-10-08 23:48
steuern-und-strafe.de78ab4fb1…—query2026-10-08 23:27
taniayovanovic.com7c42474d…—query2026-10-08 22:33
theflb.comaaf48b4e…—query2026-10-08 22:15
temizellerdanismanlik.com.tr78ffd2a6…—query2026-10-08 22:06
sportorium.ptumb.combc9643d9…—query2026-10-08 14:34
wordpress.scanfortruth.comef711599…—query2026-10-08 14:23
azosk.sk1a4d8fab…—query2026-10-08 14:15
legendcup.net7483544c…—query2026-10-04 10:28
louisstructures.com12514fea…—query2026-10-04 10:28
zetaclinic.it6e24e3ab…—query2026-10-04 04:30
247productions.nld54cfa19…—query2026-10-04 04:29
firstcallkuwait.com18888b6c…—query2026-10-04 03:22
fullpowerproperties.uk327dfa14…—query2026-10-03 10:28
theficobooster.com017b752f…—query2026-10-03 04:28
astuces-deco.pro41fe925d…—query2026-10-02 10:28
bigtonypoker.com49831af8…—query2026-10-02 04:28
vanderbilt-park.com7e33ebe2…—query2026-10-01 16:27
diabetescareth.com28812a0f…—query2026-10-01 13:40
solarcapricornio.com.br429f6353…—query2026-10-01 13:10
checkgps.comb88089c7…—query2026-10-01 13:08
sportorium.ptumb.combdb6c975…—query2026-10-01 13:08
browningconsultingtexas.comb11194ac…—query2026-09-23 13:50
condominiojavieracarrera.cla4a304ea…—query2026-09-23 13:50
greenova.app89c2699d…—query2026-09-23 13:50
dolceitalia.org1df3fce5…—query2026-09-23 13:50
harapouya.ir4af84455…—query2026-09-23 13:50
gaviticonsulting.com84c82561…—query2026-09-23 13:50
lmohphotography.com7246fc5e…—query2026-09-23 13:50
womenindev.com5f52b666…—query2026-09-23 13:50
greenbuildingfl.com422343dd…—query2026-09-23 13:50
depannage-rideaux-metalliques-91.comc685e4d6…—query2026-09-23 13:50
multi-sweep.com5d371917…—query2026-09-23 13:50
airbnblistingservice.com00e436bd…—query2026-09-23 13:50
longitudeconstruction.come8c7b1b7…—query2026-09-23 13:50
medmark.sab3dcaa07…—query2026-09-23 13:50
lexperts-comptables.com1f82bdc7…—query2026-09-23 13:50
maximatelecom.net6e8d3bcf…—query2026-09-23 13:50
americanalliancemg.combe174b8f…—query2026-09-23 13:50
opel-hoefler.dee4697c82…—query2026-09-23 13:50
diabetescareth.com15c8216c…—query2026-09-23 13:50
kohatpromotions.comca791ac9…—query2026-09-23 13:50
macroad.ita7182413…—query2026-09-23 13:50