wexboom[.]com

This domain, wexboom.com, was observed hosting a generic phishing page titled “WEXBOOM | Open the world of luck and rewards!”. The site was registered on 21 February 2026 and resolved to the IP address 172.67.222.130, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The SSL certificate presented for the host is identified as “WE1”. Early detection by PhishDestroy resulted in the domain being placed on one public security blocklist, and the same blocklist entry is reflected in the current blocklist count.

VirusTotal scanned the site and recorded detections from 2 of 95 security vendors, indicating that at least a minority of AV engines flag the domain as malicious. The site’s current HTTP status is offline, suggesting that the operators have taken the page down, but the infrastructure artefacts remain observable. Analysis indicates that the domain’s short lifespan—from registration to takedown within a few months—matches typical phishing campaign patterns that rely on fast‑flux hosting services such as Cloudflare. The presence of a dedicated SSL certificate does not mitigate risk, as attackers frequently obtain valid certificates to increase credibility.

Defenders should immediately add wexboom.com to URL filtering rules and block the associated IP 172.67.222.130 at the network perimeter. Continuous monitoring of Cloudflare‑originated IP ranges for similar short‑lived domains is recommended. Because the site is offline, threat hunting can focus on historical logs for any user‑initiated connections to the domain or its IP, and on credential leakage that may have occurred before takedown. Further intelligence gathering should include re‑scanning the domain if it reappears, and correlating any observed phishing emails that reference the “luck and rewards” wording with this indicator.