unlock-wlfi[.]com

Analysis of unlock-wlfi.com indicates a confirmed phishing domain with elevated risk, currently offline as of July 23, 2026. The domain was registered on February 21, 2026, and resolves to Cloudflare infrastructure (AS13335, IPv6 address 2a06:98c1:3120::3), a common hosting choice for phishing campaigns due to its proxy services and ease of deployment. Security vendors have flagged this domain, with 14 of 95 engines on VirusTotal detecting it as malicious, reinforcing its classification as a phishing threat. The domain appears on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer, further validating its malicious intent.

The SSL certificate is classified as WE1, a low-trust indicator often associated with automated or low-effort certificate issuance, which aligns with phishing infrastructure patterns. Gridinsoft assigns a trust score of 0/100, reflecting no legitimate reputation. While the exact content of the site remains unanalyzed, the domain name and infrastructure characteristics suggest it was designed to harvest credentials or sensitive information.

Defenders should treat this domain as a confirmed phishing threat, particularly for campaigns leveraging Cloudflare's anonymizing services. Blocking the domain at DNS and web proxy levels is recommended, along with monitoring for related indicators such as the IPv6 address and associated ASN. No brand-specific targeting is confirmed in the available data, so classification remains generic phishing.