wlfi-mall[.]cc

This domain, wlfi-mall.cc, is flagged for brand impersonation targeting Facebook, a high-profile social media platform. Analysis indicates the site presented a page titled WLFI-MALL, designed to mimic legitimate Facebook properties, likely to deceive users into disclosing credentials or other sensitive information. No evidence of a crypto drainer kit was observed, but the impersonation framework aligns with credential harvesting tactics commonly deployed in phishing campaigns. Infrastructure analysis reveals the domain was registered on October 09, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domains. It resolved to the IP address 188.114.96.3, geolocated to the United States and assigned to AS13335 (Cloudflare, Inc.), a network often leveraged to obfuscate attacker infrastructure. The domain appears on one security blocklist, while VirusTotal reports 14 out of 95 security vendors flagging it as malicious. The SSL certificate, issued by Google Trust Services (WE1), provides a veneer of legitimacy but does not mitigate the underlying threat. No Google Safe Browsing (GSB) detections were recorded at the time of analysis. The domain is currently offline, likely due to takedown actions or voluntary suspension by the hosting provider. However, the risk remains elevated for users who may have interacted with the site prior to its deactivation. Organizations are advised to monitor for indicators of compromise, including the domain, IP, and associated SSL certificate thumbprint. Users should verify the authenticity of any communication purporting to originate from Facebook and report suspicious domains to relevant security teams for further investigation. Proactive blocking of the domain and IP at the network level is recommended to prevent potential re-emergence.