wlfiprime[.]com

wlfiprime.com is currently active and has been classified as a high‑risk crypto‑scam that impersonates the Arbitrum brand. The site presents the page title “WLFI Wallet – Secure Your Cryptocurrencies with WLFI.co”, which aligns with the reported phishing kit “Seed Phrase Phishing”. The domain was registered on 17 December 2025 through Gname.com Pte. Ltd. and resolves to the Cloudflare‑hosted address 188.114.97.3, located in the United States under ASN 13335 (Cloudflare, Inc.). DNS resolution uses the Cloudflare authoritative nameservers coco.ns.cloudflare.com and matteo.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint despite the malicious intent.

Technical inspection shows an HTTP 301 redirect response, and the front‑end stack is built on Vue.js with Cloudflare Browser Insights and HTTP/3 enabled. The domain appears on a single security blocklist and has been flagged by PhishDestroy. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, confirming the malicious nature. VirusTotal analysis reports that 8 of 95 scanning engines have identified the domain as malicious, reinforcing the threat assessment. Evidence confirms that the site is designed to harvest seed phrases from users who believe they are interacting with an official Arbitrum wallet service.

No additional content has been publicly disclosed, and the exact phishing page layout remains unverified. Defenders should block the domain at network perimeter, add the IP address 188.114.97.3 to deny lists, and monitor for any DNS queries to the associated Cloudflare nameservers. Users of Arbitrum‑related services should be warned about the impersonation attempt and instructed to verify URLs before entering wallet credentials. Continuous monitoring of the domain’s certificate and DNS changes is recommended, as the infrastructure could be repointed to new IPs under the same Cloudflare account.