wlflibfinanceslive[.]xyz

Analysis of wlflibfinanceslive.xyz, observed on July 24 2026, identifies the site as a generic phishing infrastructure that has been taken offline. The domain was registered on 9 September 2025 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare (AS13335) with the A‑record resolving to 104.21.48.1, an IP located in the United States. No TLS certificate was presented during the brief scan, indicating the absence of HTTPS protection. The page title returned by the HTTP response is “Just a moment…”, which matches the limited metadata available from the capture.

Gridinsoft assigned a trust score of 0 / 100, reflecting an extremely low reputation. VirusTotal reports that eight of ninety‑five security vendors flagged the domain, confirming malicious classification by multiple independent scanners. The domain is listed on two public blocklists, specifically PhishDestroy and ScamSniffer, and both services have actively blocked access to the site. Nameserver delegation points to amos.ns.cloudflare.com and oaklyn.ns.cloudflare.com, consistent with the Cloudflare front‑end.

The current offline status prevents further live interaction, and no additional content such as login forms or credential‑harvesting pages could be retrieved. Uncertainty remains regarding the exact phishing campaign payload and targeted brands, as the page title provides no indication of the impersonated service. Defenders should continue to block the domain and associated IP address at network perimeter devices, update URL filtering lists with the observed blocklist entries, and monitor for any re‑registration attempts using the same registrar or similar naming patterns. Ongoing threat‑intel feeds should be consulted for potential resurgence, and any observed traffic to the Cloudflare‑hosted IP should be inspected for anomalous request patterns.