wlfi[.]aspendog[.]lol

Analysis of wlfi.aspendog.lol shows a domain that was registered on March 23 2026 through Global Domain Group LLC and immediately pointed to Cloudflare’s network (IP 188.114.96.3, located in Canada). The authoritative nameservers cheryl.ns.cloudflare.com and margo.ns.cloudflare.com are standard Cloudflare entries, indicating the attacker leveraged Cloudflare’s CDN and DNS services. The site presents the page title “Suspected phishing site | Cloudflare” and serves a TLS certificate issued by Let’s Encrypt (subject E7), confirming the presence of HTTPS. An HTTP request returns status code 403, suggesting the content is currently inaccessible; the domain is listed as offline by threat intel and has been blocked by the PhishDestroy sinkhole.

VirusTotal reports four detections out of ninety‑four scanning engines, and the domain appears on a single external blocklist. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. The intelligence tags the activity as a “Fake Airdrop” scam, a common social‑engineering lure that promises token distributions to harvest credentials. No additional behavioural artefacts, such as payload samples or phishing page screenshots, have been released, so the exact content and victim‑targeting vectors remain unknown.

Defenders should add wlfi.aspendog.lol to network‑level deny lists, enforce DNS filtering against the observed nameservers, and monitor for any future resolution to the same IP address. Because the domain is hosted on Cloudflare, any remediation that relies on IP blocking may affect legitimate services; therefore, URL‑based or domain‑based blocking is recommended. Continuous re‑query of VirusTotal and blocklist feeds is advised to capture any new detections that could indicate re‑activation.