wlfilivecheck[.]xyz

The domain wlfilivecheck.xyz was registered on 21 February 2026 and is currently reported as offline. DNS resolution points to the address 104.21.96.1, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. An SSL certificate labeled “WE1” is presented for the host, indicating that TLS is enabled but offering no additional trust signals. Reputation data show that the domain appears on two public blocklists and has been explicitly blocked by the PhishDestroy and ScamSniffer feeds.

VirusTotal analysis recorded 14 detections out of 93 scanned security vendors, confirming that multiple AV engines consider the host malicious. No further public intelligence such as Safe Browsing, Open Threat Exchange, or registrar‑level abuse records is available at this time. The combination of recent registration, Cloudflare hosting, active TLS, and multiple vendor detections suggests a short‑lived infrastructure typical of credential‑harvesting operations.

Because the site is offline, active probing is limited, but defenders should continue to monitor the associated IP address 104.21.96.1 for any resurgence of malicious activity, enforce blocklist updates that include wlfilivecheck.xyz, and consider adding the IP to network‑level deny lists. Organizations using security solutions that ingest VirusTotal or blocklist feeds should verify that the domain is already flagged and ensure that endpoint and web‑gateway controls reject any future connections to this host. Ongoing observation of Cloudflare‑hosted assets with similar registration patterns is advised to catch potential re‑use of the same infrastructure.