wlfi-eth[.]world

wlfi-eth.world is a newly registered domain, created on February 21, 2026, that has been identified as a crypto‑focused phishing operation. The only page title observed by crawlers is "World Liberty Fi", which matches the listed scam type of a crypto scam. DNS resolution points to the address 76.76.21.61, an Amazon Web Services host located in the United States and advertised under ASN 16509 (Amazon.com, Inc.). The hosting environment is reported to use Vercel and to enforce HTTP Strict Transport Security, indicating an attempt to present a legitimate‑looking HTTPS service.

The SSL certificate is recorded as "R12", confirming that TLS was active at the time of observation. Registration was performed through NameCheap, Inc., with authoritative nameservers dns1.registrar-servers.com and dns2.registrar-servers.com. Google Safe Browsing has flagged the domain for social engineering, and PhishDestroy lists it as blocked. The domain also appears on a single external security blocklist, and VirusTotal analysis shows that 14 of 93 scanning engines returned a positive detection, providing multiple independent confirmations of malicious intent.

Although the site has been taken offline, the infrastructure artifacts—IP address, hosting provider, TLS configuration, and registrar details—remain actionable for defenders. Recommended mitigation steps include adding wlfi-eth.world and its resolving IP to deny‑list rules, monitoring for reuse of the same AWS IP range or Vercel deployment patterns, and applying outbound filtering for known crypto‑phishing signatures. Continuous telemetry should be collected on any DNS queries for the domain, and any resurgence attempts should be investigated promptly, as threat actors often recycle similar infrastructure after takedown.