claimwlfidapps[.]vercel[.]app

Analysis of claimwlfidapps.vercel.app reveals a high-risk crypto drainer phishing domain targeting users of World Liberty Financial, as indicated by the page title 'World Liberty Financial - Easily unlock your WLFI tokens.' The domain, registered on February 21, 2026, through Tucows Domains Inc., is currently offline with an HTTP 451 status, suggesting restricted access due to legal or policy violations. Infrastructure analysis shows the domain resolves to IP 216.198.79.195, hosted on Amazon.com, Inc. (AS16509) in the United States. SSL certification is provided by Google Trust Services (WR1), a common choice for both legitimate and malicious domains, offering no definitive indication of fraud on its own.

Security vendors have flagged this domain, with 11 out of 93 engines on VirusTotal detecting malicious activity, and it appears on two security blocklists, including PhishDestroy and ScamSniffer. Google Safe Browsing classifies the site as engaging in social engineering, a common tactic for crypto drainers designed to trick users into connecting wallets or entering seed phrases. The use of Vercel hosting and HSTS enforcement aligns with patterns observed in phishing campaigns aiming to appear legitimate.

While the domain is currently offline, defenders should treat any future resolution or reappearance as a high-priority threat. Monitoring for similar domains using the same hosting provider, SSL issuer, or naming conventions is recommended. No direct evidence links this domain to a specific phishing kit, but the combination of crypto-focused branding, social engineering flags, and detection by specialized scam-blocking tools strongly supports the crypto drainer classification.