whflighting[.]com

The domain whflighting.com was registered on February 21, 2026 through Hostinger operations, UAB. It is currently classified as a high‑risk generic phishing site with an active status. The page title returned by the web server is “Page not found – WHF Lighting”, indicating an attempt to masquerade as the legitimate WHF Lighting brand. The site is associated with a banking phishing campaign. Infrastructure analysis shows the domain resolves to the IPv6 address 2a02:4780:11:1361:0:3443:3242:8, which maps to the AS47583 block owned by Hostinger International Limited in India. Authoritative name servers are ns1.dns-parking.com and ns2.dns-parking.com. Mail exchange records point to mx1.hostinger.com (priority 5) and mx2.hostinger.com (priority 10). The web service presents an HTTP 200 response and serves a Let’s Encrypt certificate (R13). Threat intelligence feeds reference the domain in one AlienVault OTX pulse and list it on a single security blocklist. PhishDestroy has actively blocked the domain. VirusTotal scans report three out of ninety‑five security vendors flagging the domain as malicious. Independent reputation services assign a Scamadviser score of 1/100 and a Gridinsoft score of 0/100, reflecting extreme distrust. Defenders should immediately add whflighting.com to DNS and URL filtering policies, and block outbound connections to its IPv6 address. Continuous monitoring of the associated MX hosts is advised, as they may be leveraged for credential harvesting. Given the active banking phishing classification, security teams should also educate users about the falsified WHF Lighting reference and encourage verification of legitimate banking communications.