ScanMalware.com
Known malicious kitcriticalphishing

Exvicy ClickFix — lure and command-and-control domains contacted by a compromised site

family: exvicy-errtraffic-2026-09

Pages that requested one of the domains published for Exvicy, a ClickFix framework rented out on a Russian-speaking forum since May 2026 and built on reused ErrTraffic code. A script injected into a hacked WordPress site opens a full-screen "Security Check" iframe from these hosts, showing a fake Cloudflare Turnstile challenge that tells the visitor to press Win+R and paste a PowerShell command.

Anchors

SMQL queryrun
contacted_host:cloudflare-check.net OR contacted_host:clickzona.net OR contacted_host:finnancialpl.com OR contacted_host:kawaiininjaclub.cfd OR contacted_host:jouncepopdownloadnow.com OR contacted_host:jumppopdownloadsecret.monster OR contacted_host:lastdayornot.top OR contacted_host:searlepub.com OR contacted_host:whirlpoploaderfast.com OR contacted_host:flarclod.top OR contacted_host:scribblebubblebibi.top OR contacted_host:boundpopclickgetfile.monster OR contacted_host:recaptcha-check.com OR contacted_host:us-addnewdevice.com

Provenance

Added: 2026-09-23 13:50
Exact hostnames only. Includes the lure hosts cloudflare-check.net and clickzona.net, finnancialpl.com (seen serving the same /embed/ lure path, not in the published list), and the published C2 and panel domains. The published list also names many ordinary websites that hosted a panel after being compromised; those are deliberately not matched here, because they are victims.
References:

Sightings (21)

HostScanScriptMatchWhen
browningconsultingtexas.comb11194ac…—query2026-09-23 13:50
condominiojavieracarrera.cla4a304ea…—query2026-09-23 13:50
greenova.app89c2699d…—query2026-09-23 13:50
dolceitalia.org1df3fce5…—query2026-09-23 13:50
harapouya.ir4af84455…—query2026-09-23 13:50
gaviticonsulting.com84c82561…—query2026-09-23 13:50
lmohphotography.com7246fc5e…—query2026-09-23 13:50
womenindev.com5f52b666…—query2026-09-23 13:50
greenbuildingfl.com422343dd…—query2026-09-23 13:50
depannage-rideaux-metalliques-91.comc685e4d6…—query2026-09-23 13:50
multi-sweep.com5d371917…—query2026-09-23 13:50
airbnblistingservice.com00e436bd…—query2026-09-23 13:50
longitudeconstruction.come8c7b1b7…—query2026-09-23 13:50
medmark.sab3dcaa07…—query2026-09-23 13:50
lexperts-comptables.com1f82bdc7…—query2026-09-23 13:50
maximatelecom.net6e8d3bcf…—query2026-09-23 13:50
americanalliancemg.combe174b8f…—query2026-09-23 13:50
opel-hoefler.dee4697c82…—query2026-09-23 13:50
diabetescareth.com15c8216c…—query2026-09-23 13:50
kohatpromotions.comca791ac9…—query2026-09-23 13:50
macroad.ita7182413…—query2026-09-23 13:50