events-wlfi[.]com

events-wlfi.com was registered on August 14, 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to the Cloudflare address 104.21.16.125, which is associated with ASN 13335 and is located in the United States. A TLS certificate labeled WE1 is present, but the site has been taken offline at the time of this assessment (July 24 2026). The page title returned by the server is “Nur einen Moment…”, a German phrase meaning “Just a moment…”. No additional content has been captured, so the exact phishing payload or credential‑stealing mechanism remains unknown.

The limited visibility of the landing page prevents confirmation of the specific technique, such as whether a cloned login form or a redirect was employed; the German title suggests the campaign may target German‑speaking users, but no brand is identified in the available data. Reputation services flag the domain as malicious. Gridinsoft assigns a trust score of 0 out of 100, indicating a high confidence of abuse. PhishDestroy lists the domain as blocked, and it appears on one external security blocklist. VirusTotal reports that six of ninety‑three scanning engines have identified the domain as malicious, reinforcing the suspicion of phishing activity.

The low detection count suggests that the campaign may be relatively new or that scanning coverage is limited. Given the observed infrastructure, defenders should enforce outbound DNS filtering for events-wlfi.com, add the IP 104.21.16.125 to network‑level blocklists, and monitor other Cloudflare‑hosted assets that share the same ASN. Security teams should also inspect web proxy logs for HTTP requests to the domain, correlate any observed POST traffic with user accounts, and consider revoking compromised credentials if evidence of credential capture appears.