wlfi-usdt[.]shop

The domain wlfi-usdt.shop was registered on September 16, 2025 through GNAME.COM PTE. LTD. and is currently hosted behind Cloudflare infrastructure, resolving to IP address 172.67.129.157 with the service location identified as Canada. The domain uses the nameservers meilani.ns.cloudflare.com and lennon.ns.cloudflare.com and presents an SSL certificate identified as WE1, indicating a valid TLS layer. HTTP requests return a 200 status and the page title is reported as WLFI-USDT, which aligns with the known impersonation of the Telegram brand. Security assessments show a Gridinsoft trust score of 0 out of 100 and VirusTotal reports that 10 of 93 security vendors flagged the domain, reflecting a high likelihood of malicious activity. The site appears on one external blocklist and is actively blocked by PhishDestroy. Risk level is classified as high and the infrastructure remains active as of the report date. While the exact payload or credential‑stealing mechanism has not been observed, the convergence of brand impersonation, low trust score, multiple vendor detections, and blocklist presence indicates a credible Telegram‑related scam. Defenders should block wlfi-usdt.shop at network and DNS layers, monitor for any resolver changes, and consider sharing indicators of compromise with threat‑sharing communities. Ongoing reconnaissance is recommended to confirm any downstream malicious behavior should the site evolve.