wlfiatomicswap[.]com

The domain wlfiatomicswap.com was identified as a phishing infrastructure impersonating Arbitrum, a cryptocurrency platform, with a focus on wallet and seed phrase theft. Registered on December 18, 2025, through Gname.com Pte. Ltd., the domain resolved to the IP address 188.114.97.3, hosted on Cloudflare's network (AS13335) in the United States. Nameservers coco.ns.cloudflare.com and matteo.ns.cloudflare.com were associated with the domain, which lacked an SSL certificate at the time of analysis. Infrastructure analysis reveals the domain was flagged by 10 of 93 security vendors on VirusTotal and appeared on one security blocklist, specifically PhishDestroy.

The domain was classified as a seed phrase phishing scam, targeting users with a fraudulent wallet interface. The page title, 'WLFI Wallet - Secure Your Cryptocurrencies with WLFI.co,' suggests an attempt to deceive victims into entering sensitive credentials under the guise of a legitimate cryptocurrency wallet service. As of July 23, 2026, the domain is offline, though its prior activity and detection by multiple security vendors indicate a deliberate effort to impersonate Arbitrum. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious nature.

Defenders are advised to monitor for re-emergence of this domain or similar infrastructure, particularly those leveraging Cloudflare hosting and lacking SSL certificates. While the exact content of the phishing page remains unanalyzed, the available evidence confirms its classification as a wallet-focused phishing operation. No additional details about the phishing kit's functionality or distribution methods are currently available.