wesfira[.]cfd

Analysis indicates that the domain wesfira.cfd was registered on June 17, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and subsequently resolved to the Cloudflare‑owned address 172.67.144.4, which is advertised as being located in the United States under ASN 13335. The site presented the page title “Messenger” and was built on a Vue.js stack delivered via Cloudflare’s HTTP/3 service. The TLS certificate was issued by Google Trust Services under the WE1 identifier, confirming the use of a valid public certificate. Threat intelligence shows the domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed.

VirusTotal scans returned 19 positive detections out of 91 submitted engines, reinforcing the malicious classification. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, indicating a complete lack of confidence in the host. The authoritative nameservers listed are athena.ns.cloudflare.com and felipe.ns.cloudflare.com, both standard Cloudflare resolvers. As of the report date the domain is listed as taken offline, but the historical artifacts remain relevant for correlation.

Defenders should add wesfira.cfd to blocklists at the network perimeter, monitor DNS logs for queries to the associated Cloudflare IP range, and flag any traffic that presents a TLS handshake with the Google Trust Services WE1 certificate in conjunction with the “Messenger” page title. Because the underlying hosting is shared across Cloudflare’s global network, blanket blocking of the IP address may impact legitimate services; therefore, rule sets should target the fully qualified domain name. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is advised to capture any future changes in detection rates.