wlfi-drops[.]online

This domain, wlfi-drops.online, is flagged as a credential harvesting phishing site designed to deceive users into submitting login credentials through fraudulent web interfaces. Analysis indicates the site mimics legitimate authentication portals, likely targeting users of financial services, email providers, or corporate platforms. The page title 'Just a moment...' suggests the use of Cloudflare or similar proxy services to obscure backend infrastructure, a common tactic in phishing campaigns to evade detection and takedown efforts. Infrastructure analysis reveals the domain was registered on September 08, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domains. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain resolves to the IP address 104.21.16.1 and appears on at least one security blocklist. Its current offline status suggests a temporary suspension, though historical resolution patterns indicate potential for reactivation under the same or similar infrastructure. Users who visited wlfi-drops.online should immediately revoke any credentials entered on the site, as they are likely compromised. Monitor accounts associated with the submitted credentials for unauthorized activity, including login attempts, password changes, or financial transactions. Enable multi-factor authentication where available to mitigate further risk. If the site was accessed in a corporate environment, report the incident to internal security teams for containment and forensic analysis. Given the domain's recent registration and low detection rate, users should remain vigilant for similar phishing attempts leveraging newly registered domains.