wlfi-drops[.]net

The domain wlfi-drops.net was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It is classified as a generic_phishing site with a high risk rating and remains active as of 12 July 2026. The registration date places the domain well within the typical window for newly created malicious infrastructure, and the lack of a legacy presence suggests a purpose‑built operation.

Technical analysis shows the domain resolves to 172.67.193.248, an address owned by AS13335 Cloudflare, Inc., located in the United States. DNS is served by the authoritative name servers damien.ns.cloudflare.com and kallie.ns.cloudflare.com, confirming use of Cloudflare’s DNS and edge services. The site presents an HTTP 403 response and advertises Cloudflare Browser Insights and HTTP/3 support, indicating the content is being delivered through Cloudflare’s reverse‑proxy platform.

The page title returned by the server is “Just a moment…”, and the SSL certificate is issued by Google Trust Services under the WE1 designation, providing a valid TLS connection. Reputation checks reveal the domain appears on one security blocklist and is flagged by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports six out of ninety‑five scanners detecting malicious activity, reinforcing the elevated threat posture.

Defenders should block wlfi-drops.net at network and DNS layers, and include its IP address in any outbound filtering rules. Continuous monitoring of the associated Cloudflare name servers is advised, as the infrastructure could be reused for additional phishing campaigns. Since the only observed content is the generic title and no further page details have been disclosed, analysts should treat any future payloads delivered from this host as potentially credential‑stealing and apply appropriate incident‑response procedures.