DNS response containing Exvicy panel's randy/stevie Cloudflare NS pair

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

Detects specific Cloudflare name server pairs ('randy.ns.cloudflare' and 'stevie.ns.cloudflare') in DNS responses. This pattern is associated with Exvicy domain management infrastructure, which has been identified as a component in adversary C2 and domain staging operations.