wlfi-bitflyer[.]com

This domain, wlfi-bitflyer.com, is flagged as a brand impersonation threat targeting Arbitrum, a layer-2 blockchain platform. Analysis indicates the site mimics a cryptocurrency wallet service, presenting itself as 'WLFI Wallet - Secure Your Cryptocurrencies with WLFI.co.' The infrastructure appears designed to deceive users into disclosing sensitive credentials or transferring assets to attacker-controlled addresses, consistent with cryptocurrency drainer kit tactics. No specific drainer kit family was identified, but the impersonation of a trusted blockchain brand aligns with known phishing methodologies in the cryptocurrency sector.

Technical indicators reveal multiple red flags. The domain was registered on December 17, 2025, through Gname.com Pte. Ltd., an uncommon registrar for legitimate cryptocurrency services. It resolves to IP address 104.21.21.231, a Cloudflare-hosted endpoint, which is frequently leveraged by threat actors to obfuscate origin servers. VirusTotal reports 7 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services, a common but not inherently trustworthy provider. Technologies detected include Vue.js, Cloudflare, and HTTP/3, which are not unusual but provide no assurance of legitimacy.

As of the latest assessment, wlfi-bitflyer.com has been taken offline, reducing immediate exposure. However, the domain remains registered and could be reactivated or repurposed. Users who interacted with the site should assume compromise of any credentials or wallet details shared. Monitoring for unauthorized transactions and revoking access to connected applications is recommended. The elevated risk classification persists due to the domain's recent creation, brand impersonation, and prior malicious activity, underscoring the need for continued vigilance in cryptocurrency-related interactions.