eligibility-wlfi[.]com

Analysis of eligibility-wlfi.com indicates a generic phishing domain registered on August 14, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolved to IP address 172.67.174.48, hosted on Cloudflare, Inc. (AS13335) infrastructure in the United States. As of July 23, 2026, the domain is offline, though it was previously flagged by at least one security blocklist and detected by 3 of 93 security vendors on VirusTotal.

The observed page title, 'Pieni hetki...', provides no clear indication of a targeted brand or specific phishing campaign, and no phishing kit or scam category has been identified in available intelligence. The domain's Gridinsoft trust score of 0/100 further supports its classification as malicious infrastructure. The SSL certificate is classified as WE1, a low-trust category often associated with automated or low-effort deployments.

Defenders should treat this domain as part of a broader phishing operation, particularly if observed in logs or proxy data prior to its takedown. While the exact content of the phishing page remains unanalyzed, the combination of Cloudflare hosting, recent registration, and detection by multiple security vendors suggests it was actively used for malicious purposes. Organizations should review historical DNS and web proxy logs for connections to 172.67.174.48 or eligibility-wlfi.com and correlate with any suspicious user activity or credential submissions during the domain's active period.