DNS NS record resolution to Exvicy/ErrTraffic Cloudflare nameserver pair

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects DNS queries for domains resolving to specific Cloudflare nameserver pairs associated with the Exvicy malware distribution framework. The rule monitors for NS records pointing to 'randy.ns.cloudflare.com' and 'stevie.ns.cloudflare.com', optionally filtering by domains containing keywords commonly used in Exvicy-themed phishing or C2 infrastructure.