shortyyy[.]com

Analysis of shortyyy.com shows a newly registered domain created on March 06, 2026 through NameCheap, Inc. The domain resolves to the IP address 13.35.58.39, which belongs to AS13335 Cloudflare, Inc., indicating the use of Cloudflare’s content‑delivery network for hosting. Its authoritative nameservers are arushi.ns.cloudflare.com and jack.ns.cloudflare.com, confirming the Cloudflare infrastructure. An SSL certificate issued by Google Trust Services under the WE1 trust anchor is present, providing a valid HTTPS handshake despite the site being offline. HTTP probing returns a 404 status, meaning no web page is currently served at the address.

The domain has been listed on a single security blocklist and has been blocked by the PhishDestroy service, suggesting detection by anti‑phishing filters. VirusTotal reports that one of ninety‑four security vendors flagged the domain, reinforcing the suspicion of malicious use. No additional public threat intelligence (such as Safe Browsing, OTX, or brand‑specific identifiers) is available, and the page title or content has not been captured, leaving the exact phishing payload or targeted brand unknown.

The combination of a recent registration, Cloudflare hosting, a valid SSL certificate, and detection by both a blocklist and a security vendor points to a likely phishing operation that has already been taken offline. Defenders should continue to block the domain and its associated IP, monitor for any re‑activation or related domains using the same nameservers or IP range, and consider adding shortyyy.com to local deny lists. Ongoing vigilance is recommended because the underlying infrastructure (Cloudflare) can be reused for future malicious domains, and the limited detection history may not reflect the full scope of any ongoing campaign.