wlfispace[.]com

Analysis of wlfispace.com shows that the domain was registered through NameCheap, Inc. on 11 November 2025 and resolves to the IP address 162.0.215.135, which belongs to AS22612 operated by Namecheap in the United States. The domain is currently taken offline, but historical data indicate that it was listed on at least one security blocklist and was blocked by PhishDestroy. The authoritative name servers are dns1.namecheaphosting.com and dns2.namecheaphosting.com, both associated with the registrar’s hosting service. No TLS certificate was observed, meaning the site was served over plain HTTP when it was reachable.

The page title retrieved from the site, "WLFI Token — Crypto Swap Platform," suggests a cryptocurrency‑focused service, and the listed scam type is brand impersonation targeting the brand "across." Gridinsoft assigns a trust score of 0 out of 100, indicating extreme distrust. VirusTotal records show that 16 of 95 scanning engines flagged the domain as malicious, reinforcing the suspicion of malicious intent. The combination of a newly created domain, low trust score, multiple vendor detections, and explicit brand‑impersonation labeling points to a high likelihood that the site was used to lure victims into a fraudulent crypto swap or token offering. What remains uncertain is the exact payload delivered to visitors, the presence of any credential‑stealing forms, or the extent of victim attribution, as no page content beyond the title has been publicly analyzed.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any residual traffic to the associated IP, and add the domain to internal blocklists. Because the domain lacks SSL, any future re‑use would be readily detectable by TLS inspection. Incident response teams should also review logs for any connections to 162.0.215.135 since the domain’s creation date, and consider sharing the indicator set with threat‑intel platforms to aid broader community detection.