wlfiweb3[.]com

This domain wlfiweb3.com was registered on 18 December 2025 via Gname.com Pte. Ltd. and points to the Cloudflare‑owned address 104.21.42.179 located in the United States under ASN 13335. The site resolves without an HTTPS certificate, indicating a lack of transport‑layer encryption. The page title returned from the live host reads “WLFI Wallet – Secure Your Cryptocurrencies with WLFI.co,” and the associated scam classification is a Wallet/Seed Phishing operation that leverages a known Seed Phrase Phishing kit. The campaign targets the Arbitrum brand, as indicated by the “impersonates: arbitrum” tag, and attempts to harvest cryptocurrency seed phrases from victims.

Reputation checks show a Gridinsoft trust score of 0 / 100 and the domain appears on a single security blocklist. VirusTotal scans report 14 of 93 antivirus engines flagging the domain as malicious, confirming a consensus of threat. The domain is currently listed as offline, and PhishDestroy has already blocked it. Nameservers are coco.ns.cloudflare.com and matteo.ns.cloudflare.com, both typical of Cloudflare‑hosted services.

The evidence suggests an active phishing infrastructure that has been identified and mitigated, but the underlying registration and hosting details remain unchanged, allowing potential re‑use of the same infrastructure for future campaigns. Defenders should continue to monitor the domain’s IP address and associated Cloudflare nameservers for any resurgence, enforce blocklist entries in perimeter security appliances, and update threat intelligence feeds with the registration and kit signatures. Additional verification through passive DNS or sinkhole data can confirm whether the IP is being reused. Until the infrastructure is fully retired, organizations handling Arbitrum‑related assets should treat any traffic to wlfiweb3.com as malicious and block it at the network edge.