wa-fi-store[.]site

Analysis as of July 25, 2026 indicates that the domain wa-fi-store.site was registered on March 19, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The authoritative name servers are ns1.ifastnet14.org and ns2.ifastnet14.org, and the domain resolves to the IPv4 address 31.22.7.243, which is announced by I Fastnet Ltd in the United Kingdom. The host presents a TLS certificate issued by Let’s Encrypt (R12) and the MX record points to the domain itself (priority 0). The site’s HTML title is recorded as “عالم وافي Wafi SA”.

No additional page content has been captured; therefore the precise phishing lures or credential‑collection mechanisms remain unverified. The domain appears on a single public blocklist, PhishDestroy, and has been reported as taken offline. Independent trust scoring from Gridinsoft assigns a rating of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal has processed the site with 94 scanning engines, none of which reported a detection at the time of analysis; this absence does not constitute validation of safety.

The combination of recent registration, low‑reputation hosting, a self‑signed DNS configuration, and inclusion on a dedicated anti‑phishing blocklist collectively supports the classification of wa-fi-store.site as a phishing infrastructure. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑appearance of the IP address or associated name servers, and consider adding the host to internal threat‑intel feeds. Ongoing observation of the registrar PDR Ltd. and the hosting provider I Fastnet Ltd. may reveal additional campaigns. Because the page content has not been publicly archived, analysts are encouraged to request a snapshot from a web‑capture service should the site become active again, to confirm the exact victim‑targeting technique.