con[.]wlfi[.]lc

The domain con.wlfi.lc is currently classified as a high‑risk generic phishing site. It is active as of July 12 2026 and returns an HTTP 521 status code, indicating that the origin server is unavailable while the Cloudflare edge continues to respond. The site presents the page title “Invite Code Not Found,” which aligns with the known phishing vector that leverages invite‑code prompts to harvest credentials.

Infrastructure analysis shows the domain is served through Cloudflare, Inc., using the IP address 104.21.18.187 that belongs to AS13335, a Cloudflare network located in the United States. The TLS certificate is issued by Google Trust Services under the “WE1” name, confirming that the connection is encrypted with a trusted certificate chain. Cloudflare’s HTTP/3 support is also detected, indicating modern transport protocols are in use.

Threat intelligence indicates that the domain appears on a single security blocklist, specifically PhishDestroy, and VirusTotal records show that 10 of 95 scanned security vendors have flagged the host as malicious. The combination of a phishing‑related page title, the high‑risk classification, and the presence on an active blocklist provides concrete evidence of malicious intent, despite the lack of direct content analysis.

Defenders should immediately block DNS resolution and HTTP traffic to con.wlfi.lc, incorporate the domain into existing URL filtering policies, and monitor for any related payloads that reference the “Invite Code” string. Continued observation of the underlying origin server is advised, as the 521 response may mask a transient backend that could host credential‑stealing pages. Updating intrusion‑detection signatures to include the observed SSL fingerprint and IP address will help mitigate exposure.