wlfi-xlm[.]com

Analysis on July 24, 2026 indicates that wlfi-xlm.com is an active domain registered through Tucows Domains Inc. on February 21, 2026. The site returns HTTP 200 and presents a page title identical to the domain name. It is hosted on an IP address 67.223.118.136, which belongs to AS22612 Namecheap, Inc. in the United States. The TLS certificate is a Sectigo Limited DV certificate issued by the Sectigo Public Server Authentication CA R36, confirming that the connection is encrypted but not providing any indication of legitimacy. The server reports LiteSpeed as the underlying web technology.

Reputation data shows that five of ninety‑three VirusTotal scanners have flagged the domain, and the domain is listed on three external blocklists. It is also explicitly blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious classification. The authoritative name servers are dns1.namecheaphosting.com and dns2.namecheaphosting.com, typical of low‑cost hosting providers. The available evidence points to a generic phishing operation, but the specific payload, targeted brand, or credential‑collection mechanism has not been observed in the current data set.

Consequently, the exact phishing vector and victim profile remain uncertain. Defenders should treat wlfi-xlm.com as high‑risk. Recommended actions include adding the domain and its IP address to network deny lists, updating web filtering and email security policies to block any URLs containing the domain, and monitoring DNS queries for look‑ups to the associated name servers. Incident response teams should also consider sharing the indicators of compromise with threat‑intel sharing platforms to improve collective detection. Continuous re‑evaluation is advised, as the infrastructure may evolve or additional malicious content could be deployed.