wlcoinpusher2[.]com

This domain, wlcoinpusher2.com, is flagged as an active phishing site targeting users through a crypto-themed lure. Analysis indicates the domain was registered on August 27, 2025, through Dynadot LLC, a registrar frequently associated with fraudulent domains. The site resolves to 104.21.3.220, hosted on Cloudflare's network (AS13335), which is commonly used to obfuscate malicious infrastructure. The page title, 'WL Coin Pusher,' suggests an attempt to impersonate a cryptocurrency platform or service, though the exact content and mechanics of the scam remain unverified due to the lack of direct page analysis. Infrastructure review reveals the domain is protected by Cloudflare, utilizing nameservers bailey.ns.cloudflare.com and trey.ns.cloudflare.com, and employs Cloudflare Browser Insights and HTTP/3. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which does not mitigate the phishing risk. The domain is currently active, returning an HTTP 200 status, and has been blocked by at least one security vendor, PhishDestroy. VirusTotal reports 11 out of 95 security vendors flagging the domain as malicious, providing further evidence of its fraudulent nature. The domain's registration age, combined with its presence on a security blocklist and detection by multiple security vendors, supports the classification of high-risk phishing activity. Defenders should treat this domain as confirmed malicious and prioritize blocking it at the network and endpoint levels. Monitoring for related domains registered through the same registrar or resolving to the same IP may help identify additional threats. Given the crypto-themed branding, users should be alerted to potential credential harvesting or fraudulent transaction attempts associated with this site.