xxbum-shorts[.]com

Analysis of xxbum-shorts.com (seed d73ab6) confirms an active high-risk phishing domain targeting users through malvertising vectors. The domain was registered on March 24, 2026, and remains operational as of July 12, 2026, resolving to IP 104.21.79.111 behind Cloudflare infrastructure. Page metadata identifies the title as 'Shorts | xxBumShorts,' though the exact content and intended victim profile are not yet fully analyzed. Technical indicators reveal the use of Node.js, Vue.js, Nuxt.js, and Express frameworks, alongside the inclusion of JuicyAds—a known malvertising network—suggesting the site may serve malicious advertisements or redirect users to exploit kits. The presence of HSTS and Cloudflare Browser Insights further aligns with tactics observed in credential-harvesting or drive-by download campaigns. SSL certification is provided by Let's Encrypt, a common choice for both legitimate and malicious sites. The domain is flagged by 15 security vendors on VirusTotal and appears in 22 threat intelligence pulses on AlienVault OTX. It is currently blocked by four security blocklists, including SEAL, MetaMask, PhishDestroy, and BLP-Malware, with a Gridinsoft trust score of 0/100. While the specific phishing kit or targeted brand remains unconfirmed, the combination of malvertising components, modern JavaScript frameworks, and Cloudflare hosting is consistent with high-velocity phishing operations. Defenders should treat this domain as actively malicious. Recommended actions include blocking the domain and its resolved IP at the network level, monitoring for connections to 104.21.79.111, and reviewing logs for interactions with JuicyAds or associated malvertising domains. Further analysis of the site’s payload—if accessible—may clarify the exact phishing mechanism or targeted sector.